Have you contacted Mozilla to see what they recommend in this type of scenario?
https://bugzilla.mozilla.org/show_bug.cgi?id=1152966
I put this on HN because somewhere there's probably somebody who's detected a security problem related to this and is trying to track it down.
A likely possibility is that it's some malware that's already on the Firefox blacklist[1], and they're trying to get past the blacklist by stealing the identity of a valid add-on.