An identity-stealing keylogger that disguises itself as a Firefox extension and installs silently in the background was discovered Tuesday by security vendor McAfee.

Firefox's extensions have been criticized for lax security, in particular that they're not digitally signed to vouchsafe their contents.