Sunday, July 14, 2024

Hackers Exploit Progressive Web Apps to Steal Passwords

In a concerning development for cybersecurity, hackers are increasingly leveraging Progressive Web Apps (PWAs) to execute sophisticated phishing attacks aimed at stealing user credentials.

This emerging threat has been highlighted by security researcher mr.d0x, who has detailed the technique in a recent blog post.

PWAs are web-based applications built using standard web technologies like HTML, CSS, and JavaScript.

They are designed to offer a seamless user experience similar to native applications, integrating closely with the operating system to provide features such as push notifications and offline capabilities.

Unlike traditional web apps, PWAs can be installed on a user’s device and appear as standalone applications with their icons and windows.

The Phishing Technique

The phishing method using PWAs exploits their ability to mimic native applications convincingly.

According to mr.d0x, the attack typically unfolds as follows:

1. Victim Accesses Malicious Website: The user is lured to a malicious website controlled by the attacker.

2. Prompt to Install PWA: The website prompts the user to install a PWA, often disguised as a legitimate application such as “Microsoft Login.”

3. Installation and Redirection: Once the user installs the PWA, it opens a window that closely resembles a legitimate login page, complete with a fake URL bar displaying a trusted URL.

Application Installation

4. Credential Theft: The user, believing the page to be authentic, enters their login credentials, which are then captured by the attacker.

Scan Your Business Email Inbox to Find Advanced Email Threats - Try AI-Powered Free Threat Scan

Why PWAs Are Effective for Phishing

One of the key reasons PWAs are effective for phishing is their ability to hide the browser’s address bar, making it difficult for users to verify the authenticity of the URL.

This feature allows attackers to create a highly convincing fake login page.

Additionally, the installation process for PWAs is quick and requires minimal user interaction, increasing the likelihood of successful attacks.

The use of PWAs for phishing is particularly concerning because they exploit the trust users place in installed applications.

Unlike traditional phishing websites, which users might recognize and avoid, PWAs can appear as legitimate applications on a user’s device, complete with familiar icons and names.

Kaspersky Researchers detailed the attack using Google Chrome and Chromium-based browsers.

“Installing a PWA (if the respective website supports it) is very simple. Just click an inconspicuous button in the browser’s address bar and confirm the installation. Here’s how it’s done, using the Google Drive PWA as an example”, researchers added.

Chromium Browser

Protecting Against PWA Phishing

To mitigate the risk of falling victim to PWA-based phishing attacks, users should exercise caution when prompted to install applications from unfamiliar sources.

Security experts recommend regularly reviewing installed PWAs and using reliable security solutions that can detect and warn against phishing attempts.

Additionally, users should be aware that legitimate PWAs should not display a URL bar, and any application that does should be treated with suspicion.

As cybercriminals continue to innovate, the use of PWAs for phishing represents a significant threat to online security.

Awareness and vigilance are crucial in protecting against these sophisticated attacks.

Users can better safeguard their credentials and personal information from malicious actors by understanding the risks and taking proactive measures.

For more detailed information on this emerging threat, visit the original research by mr.d0x and additional insights from Kaspersky.

Free Webinar! 3 Security Trends to Maximize MSP Growth -> Register For Free


Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles