Security News Malicious Chrome extensions can spoof password managers in new attack

[Jonny Quest]

Content source

https://www.bleepingcomputer.com/news/security/malicious-chrome-extensions-can-spoof-password-managers-in-new-attack/

This is the part that caught my eye.

In SquareX's demonstration, the attackers impersonate the 1Password password manager extension by first disabling the legitimate one using the 'chrome.management' API, or if the permissions aren't available, user interface manipulation tactics to hide it from the user.

Simultaneously, the malicious extension switches its icon to mimic that of 1Password, changes its name accordingly, and displays a fake login popup that matches the appearance of the real one.

To force the user into entering their credentials, when attempting to log in to a site, a fake "Session Expired" prompt is served, making the victim think they were logged out.

This will prompt the user to log back into 1Password through a phishing form that sends inputted credentials back to the attackers.

 

[Jonny Quest]

@oldschool I thought about you and your post when I saw this article on Bleeping Computer.

Advice Request - What are some secure password manager options for Windows, Android and IOS?

I've recently run out of my paid password provider subscription and was curious as to what some of you would recommend going into 2025. I've seen a lot of posts about Bitwarden, Proton, KeePass and 1password and was wondering if those are still the go-to options or if Nordpass etc are in the...

malwaretips.com

 

[mojeks]

@Jonny Quest, this is quite alarming and hoping that 1Password quickly finds solutions to this for the safety of users.

 

[MoutinhoH]

This is alarming yes! How does a common internet/google/chrome user protect themselves from this sophisticated type of hacking?

 

[Gandalf_The_Grey]

Only use a minimal amount of trusted extensions

 

[oldschool]

@oldschool I thought about you and your post when I saw this article on Bleeping Computer.

Advice Request - What are some secure password manager options for Windows, Android and IOS?

I've recently run out of my paid password provider subscription and was curious as to what some of you would recommend going into 2025. I've seen a lot of posts about Bitwarden, Proton, KeePass and 1password and was wondering if those are still the go-to options or if Nordpass etc are in the...

malwaretips.com

This article highlights how the 'chrome.management' API is ripe for the pickings. I personally rely mainly on my little black book for password management, especially critical ones.

And it goes without saying that users should ...

Only use a minimal amount of trusted extensions

 

[Vitali Ortzi]

Only use a minimal amount of trusted extensions

I'm thinking about downloading extensions by their Id rather then searching their name that way I will only get the trusted extension

 

[Vitali Ortzi]

This is alarming yes! How does a common internet/google/chrome user protect themselves from this sophisticated type of hacking?

Pretty much not downloading random extensions rather only well vetted ones from popular companies with security standards

 

[Vitali Ortzi]

@Jonny Quest, this is quite alarming and hoping that 1Password quickly finds solutions to this for the safety of users.

They can't do anything about it it's a chrome issue and google needs to secure it on as pretty much to this day that store is filled with malicious extensions

 

[oldschool]

Feds Link $150M Cyberheist to 2022 LastPass Hacks – Krebs on Security

 

[bazang]

This is alarming yes! How does a common internet/google/chrome user protect themselves from this sophisticated type of hacking?

Knowledge. Not software.

 

[rashmi]

Does this affect a password manager with a local database only?

 

[Jonny Quest]

Does this affect a password manager with a local database only?

It doesn't sound like it, like with KeePass? That's what I was thinking, that if I were truly concerned, I could uninstall the Proton Pass extensions and just work from the desktop app (in my case) and copy and paste from there. Probably like you could also do with the Bitwarden desktop app.

But would there be a security risk in my doing it that way, as far as what may be stored in Clipboard, or in the browser somewhere, compared to just typing things in?

 

[rashmi]

It doesn't sound like it, like with KeePass? That's what I was thinking, that if I were truly concerned, I could uninstall the Proton Pass extensions and just work from the desktop app (in my case) and copy and paste from there. Probably like you could also do with the Bitwarden desktop app.

But would there be a security risk in my doing it that way, as far as what may be stored in Clipboard, or in the browser somewhere, compared to just typing things in?

I meant a password manager with a local database and an extension, but no cloud database. I use Enpass password manager, which has no cloud database. If I'm correct, some password managers have a different password for the cloud database. I guess it would help in this scenario.

 

[MoutinhoH]

Only use a minimal amount of trusted extensions

yah... at this moment, how can I validate that I have none of those malicious extensions on my PC?

 

[oldschool]

yah... at this moment, how can I validate that I have none of those malicious extensions on my PC?

Look at your installed extensions, search for compromised extensions, and look at the list like here: Targeted supply chain attack against Chrome browser extensions

Create a security configuration thread of your own here at PC Setup Configuration Help & Showcase and list your extensions. Members will review your config.

 

[Zero Knowledge]

What you need is an enterprise browser or whitelisting software . Both will defeat this attack, sadly though this tech is enterprise only at the moment.

 

[i7ii]