Hackers Use Progressive Web Apps to Steal Passwords

Hackers are increasingly exploiting Progressive Web Apps (PWAs) for sophisticated phishing attacks to steal user credentials, as highlighted by security researcher mr.d0x. PWAs, built using HTML, CSS, and JavaScript, offer a user experience similar to native apps, including features like push notifications and offline capabilities.

Unlike traditional web apps, PWAs can be installed on devices and function as standalone applications with their icons and windows.

Phishing Method

The phishing method using PWAs exploits their ability to convincingly mimic native applications. According to mr.d0x, the attack typically unfolds as follows:

1. Victim Accesses Malicious Website: The user is lured to a malicious website controlled by the attacker.
2. Prompt to Install PWA: The website prompts the user to install a PWA, often disguised as a legitimate application like “Microsoft Login.”
3. Installation and Redirection: After installation, the PWA opens a window that closely resembles a legitimate login page, complete with a fake URL bar displaying a trusted URL.
4. Credential Theft: The user, believing the page is authentic, enters their login credentials, which are then captured by the attacker.

PWAs are particularly effective for phishing because they can hide the browser’s address bar, making it difficult for users to verify the URL’s authenticity. This allows attackers to create convincing fake login pages. Additionally, PWAs install quickly with minimal user interaction, increasing the likelihood of successful attacks.

The use of PWAs for phishing is concerning because they exploit the trust users place in installed applications. Unlike traditional phishing websites, which users might recognize and avoid, PWAs can appear as legitimate applications on a user’s device, complete with familiar icons and names.

Kaspersky researchers detailed the attack using Google Chrome and Chromium-based browsers. They noted that installing a PWA is simple: users just click an inconspicuous button in the browser’s address bar and confirm the installation, as seen with the Google Drive PWA.

Protecting Against PWA Phishing

To mitigate the risk of PWA-based phishing attacks, users should exercise caution when prompted to install applications from unfamiliar sources. Security experts recommend regularly reviewing installed PWAs and using reliable security solutions that can detect and warn against phishing attempts.

Additionally, users should be aware that legitimate PWAs do not display a URL bar, and any application that does should be treated with suspicion. As cybercriminals continue to innovate, the use of PWAs for phishing represents a significant threat to online security. Awareness and vigilance are crucial in protecting against these sophisticated attacks.

By understanding the risks and taking proactive measures, users can better safeguard their credentials and personal information from malicious actors. For more detailed information on this emerging threat, visit the original research by mr.d0x and additional insights from Kaspersky.