A botnet posing as a legitimate Firefox add-on is scanning sites visited by compromised computers looking for SQL injection vulnerabilities.