cyber security

Hackers Exploit Progressive Web Apps to Steal Passwords

In a concerning development for cybersecurity, hackers are increasingly leveraging Progressive Web Apps (PWAs) to execute sophisticated phishing attacks aimed at stealing user credentials.

This emerging threat has been highlighted by security researcher mr.d0x, who has detailed the technique in a recent blog post.

PWAs are web-based applications built using standard web technologies like HTML, CSS, and JavaScript.

They are designed to offer a seamless user experience similar to native applications, integrating closely with the operating system to provide features such as push notifications and offline capabilities.

Unlike traditional web apps, PWAs can be installed on a user’s device and appear as standalone applications with their icons and windows.

The Phishing Technique

The phishing method using PWAs exploits their ability to mimic native applications convincingly.

According to mr.d0x, the attack typically unfolds as follows:

1. Victim Accesses Malicious Website: The user is lured to a malicious website controlled by the attacker.

2. Prompt to Install PWA: The website prompts the user to install a PWA, often disguised as a legitimate application such as “Microsoft Login.”

3. Installation and Redirection: Once the user installs the PWA, it opens a window that closely resembles a legitimate login page, complete with a fake URL bar displaying a trusted URL.

Application Installation

4. Credential Theft: The user, believing the page to be authentic, enters their login credentials, which are then captured by the attacker.

Scan Your Business Email Inbox to Find Advanced Email Threats - Try AI-Powered Free Threat Scan

Why PWAs Are Effective for Phishing

One of the key reasons PWAs are effective for phishing is their ability to hide the browser’s address bar, making it difficult for users to verify the authenticity of the URL.

This feature allows attackers to create a highly convincing fake login page.

Additionally, the installation process for PWAs is quick and requires minimal user interaction, increasing the likelihood of successful attacks.

The use of PWAs for phishing is particularly concerning because they exploit the trust users place in installed applications.

Unlike traditional phishing websites, which users might recognize and avoid, PWAs can appear as legitimate applications on a user’s device, complete with familiar icons and names.

Kaspersky Researchers detailed the attack using Google Chrome and Chromium-based browsers.

“Installing a PWA (if the respective website supports it) is very simple. Just click an inconspicuous button in the browser’s address bar and confirm the installation. Here’s how it’s done, using the Google Drive PWA as an example”, researchers added.

Chromium Browser

Protecting Against PWA Phishing

To mitigate the risk of falling victim to PWA-based phishing attacks, users should exercise caution when prompted to install applications from unfamiliar sources.

Security experts recommend regularly reviewing installed PWAs and using reliable security solutions that can detect and warn against phishing attempts.

Additionally, users should be aware that legitimate PWAs should not display a URL bar, and any application that does should be treated with suspicion.

As cybercriminals continue to innovate, the use of PWAs for phishing represents a significant threat to online security.

Awareness and vigilance are crucial in protecting against these sophisticated attacks.

Users can better safeguard their credentials and personal information from malicious actors by understanding the risks and taking proactive measures.

For more detailed information on this emerging threat, visit the original research by mr.d0x and additional insights from Kaspersky.

Free Webinar! 3 Security Trends to Maximize MSP Growth -> Register For Free

Guru baran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Hackers Claiming Dettol Data Breach: 453,646 users Impacted

A significant data breach has been reported by a threat actor known as 'Hana,' who claims to have compromised the…

2 days ago

CrowdStrike Update Triggers Widespread Windows BSOD Crashes

A recent update from cybersecurity firm CrowdStrike has caused significant disruptions for Windows users, leading to widespread reports of Blue…

2 days ago

Operation Spincaster Disrupts Approval Phishing Technique that Drains Victim’s Wallets

Chainalysis has launched Operation Spincaster, an initiative to disrupt approval phishing scams that have drained billions from victims' wallets. This…

2 days ago

Octo Tempest Know for Attacking VMWare ESXi Servers Added RansomHub & Qilin to Its Arsenal

Threat actors often attack VMware ESXi servers since they accommodate many virtual machines, which link to a variety of systems…

3 days ago

TAG-100 Actors Using Open-Source Tools To Attack Gov & Private Orgs

Hackers exploit open-source tools to execute attacks because they are readily available, well-documented, and often have extensive community support, making…

3 days ago

macOS Users Beware Of Weaponized Meeting App From North Korean Hackers

Meeting apps are often targeted and turned into weapons by hackers as they are largely employed for communication and collaboration,…

3 days ago