zekrahminatorMcAfee has recently discovered a new virus with an interesting characteristic- it installs itself as a Firefox extension. Calling itself the legitimate extension numberedlinks, it acts as a keylogger once installed. It bypasses the standard Firefox security of an installation prompt by not using the .XPI expansion pack filetype. Geok Meng Ong from McAfee labs "called on users to take extreme caution when installing unsigned Firefox extensions from untrustworthy sources", though most Firefox extensions are not signed, and very few websites are allowed to distribute them.

Source: Heise-security