Some videos on YouTube demonstrate how a Firefox extension can collect login information used to login to websites such as Facebook.
After installing this tool/malware as Firefox Add-on, I observed the activity of my browser using Firebug. My username and password was sent to a server via Ajax request.
I contacted the author. He said that he can embed this script to any Firefox Add-on.
How can I securely use Firefox Add-ons? I installed 3 types of Antivirus and Firewall. But none of that was able to detect this malware.