Hackers Exploit Progressive Web Apps to Steal Passwords

In a concerning development for cybersecurity, hackers are increasingly leveraging Progressive Web Apps (PWAs) to execute sophisticated phishing attacks aimed at stealing user credentials.

This emerging threat has been highlighted by security researcher mr.d0x, who has detailed the technique in a recent blog post.

PWAs are web-based applications built using standard web technologies like HTML, CSS, and JavaScript.

They are designed to offer a seamless user experience similar to native applications, integrating closely with the operating system to provide features such as push notifications and offline capabilities.

Unlike traditional web apps, PWAs can be installed on a user’s device and appear as standalone applications with their icons and windows.

The Phishing Technique

The phishing method using PWAs exploits their ability to mimic native applications convincingly.

According to mr.d0x, the attack typically unfolds as follows:

1. Victim Accesses Malicious Website: The user is lured to a malicious website controlled by the attacker.

2. Prompt to Install PWA: The website prompts the user to install a PWA, often disguised as a legitimate application such as “Microsoft Login.”

3. Installation and Redirection: Once the user installs the PWA, it opens a window that closely resembles a legitimate login page, complete with a fake URL bar displaying a trusted URL.

4. Credential Theft: The user, believing the page to be authentic, enters their login credentials, which are then captured by the attacker.

Scan Your Business Email Inbox to Find Advanced Email Threats - Try AI-Powered Free Threat Scan

Why PWAs Are Effective for Phishing

One of the key reasons PWAs are effective for phishing is their ability to hide the browser’s address bar, making it difficult for users to verify the authenticity of the URL.

This feature allows attackers to create a highly convincing fake login page.

Additionally, the installation process for PWAs is quick and requires minimal user interaction, increasing the likelihood of successful attacks.

The use of PWAs for phishing is particularly concerning because they exploit the trust users place in installed applications.

Unlike traditional phishing websites, which users might recognize and avoid, PWAs can appear as legitimate applications on a user’s device, complete with familiar icons and names.

Kaspersky Researchers detailed the attack using Google Chrome and Chromium-based browsers.

“Installing a PWA (if the respective website supports it) is very simple. Just click an inconspicuous button in the browser’s address bar and confirm the installation. Here’s how it’s done, using the Google Drive PWA as an example”, researchers added.

Protecting Against PWA Phishing

To mitigate the risk of falling victim to PWA-based phishing attacks, users should exercise caution when prompted to install applications from unfamiliar sources.

Security experts recommend regularly reviewing installed PWAs and using reliable security solutions that can detect and warn against phishing attempts.

Additionally, users should be aware that legitimate PWAs should not display a URL bar, and any application that does should be treated with suspicion.

As cybercriminals continue to innovate, the use of PWAs for phishing represents a significant threat to online security.

Awareness and vigilance are crucial in protecting against these sophisticated attacks.

Users can better safeguard their credentials and personal information from malicious actors by understanding the risks and taking proactive measures.

For more detailed information on this emerging threat, visit the original research by mr.d0x and additional insights from Kaspersky.

Free Webinar! 3 Security Trends to Maximize MSP Growth -> Register For Free