Your password manager is under attack: How to defend yourself against a new threat

6 hours ago 3

Do you sometimes consciousness stuck successful a Catch-22 regarding your semipermanent credential absorption strategy?

You are.

On the 1 hand, if the tech manufacture has its mode -- to abolish each passwords and regenerate them with passkeys -- users volition yet person astir nary prime but to trust connected password managers for signing successful to their favourite sites and apps. Yes, the days of committing idiosyncratic IDs and passwords to representation oregon cryptically scratching your passwords into an aged time planner are numbered.

Also: Is your Microsoft relationship passwordless yet? Why it (probably) should beryllium and however to bash it right

On the different hand, malicious actors are the lions astatine our gate. All the password absorption solution providers ZDNET spoke with admit that they're nether changeless onslaught by hackers trying to entree the proverbial keys to the kingdom and the riches they protect.

"Password managers are high-value targets and look changeless attacks crossed aggregate surfaces, including unreality infrastructure, lawsuit devices, and browser extensions," said NordPass PR manager Gintautas Degutis. "Attack vectors scope from credential stuffing and phishing to malware-based exfiltration and proviso concatenation risks."

Googling the operation "password manager hacked" yields a distressingly agelong database of incursions. Fortunately, successful astir of those cases, passwords and different delicate accusation were sufficiently encrypted to bounds the damage.

Also: 10 passkey endurance tips: Prepare for your passwordless aboriginal now

Earlier this year, Picus Security published probe indicating that hackers are redoubling their efforts to interruption into password managers. According to a release from the firm, "25% of malware [now] targets credentials successful password stores -- a 3X summation from 2023."

Picus Security co-founder Süleyman Özarslan noted that "threat actors are leveraging blase extraction methods, including representation scraping, registry harvesting, and compromising section and cloud-based password stores, to get credentials that springiness attackers the keys to the kingdom." Threat actors are leaving nary chromatic unturned successful hopes of breaking into your password manager.

A caller and terrifying threat

One of the astir caller and terrifying threats to marque headlines came from SquareX, a institution selling solutions that absorption connected the real-time detection and mitigation of browser-based web attacks. SquareX spends a large woody of its clip obsessing implicit the grade to which browser hold architectures correspond a imaginable vector of onslaught for hackers.

Also: I recovered a malicious Chrome hold connected my strategy - here's however and what I did next

Browser extensions are those small(ish) applications that galore of america plug into Chrome, Firefox, Edge, and different browsers to heighten our web experiences. From 1 browser to the next, there's an underlying architecture that serves arsenic the enabling instauration for specified browser extensions to tally (in overmuch the aforesaid mode our smartphone and machine operating systems alteration the apps we instal connected them to run).

In the people of trying to observe definite browser hold vulnerabilities earlier malicious actors do, SquareX announced successful February that it recovered a sneaky mode for a malicious Chrome hold to impersonate 1Password's password absorption extension. Although the announcement sounds similar atrocious quality for Chrome and 1Password users, it's really overmuch worse. The find is applicable to all password managers connected Chrome, and it's applicable to all extensions connected all fashionable browsers.

SquareX didn't azygous retired Chrome oregon 1Password due to the fact that it recovered them to beryllium inherently much susceptible than different browsers oregon password managers -- oregon different extensions for that matter. "We picked Chrome arsenic it's the astir utilized browser some wrong endeavor and successful the B2C space," said SquareX laminitis Vivek Ramachandran successful an interrogation with ZDNET.

Also: Hackers stole this engineer's 1Password database. Could it hap to you?

Ramachandran emphasized that astir extensions, careless of the browsers they tally on, person akin information issues. For example, Firefox and Chromium-based browsers specified arsenic Chrome and Edge person the aforesaid issues owed chiefly to however technologies similar JavaScript and WebAssembly work.

So, what precisely did SquareX discover? And what measures tin you instrumentality to forestall your password manager and different extensions from being exploited?

Here's the archetypal happening to cognize astir the exploit, which SquareX refers to arsenic a "polymorphic extension":

How impostor extensions bash their soiled work

It tricks users into moving with an impostor extension.

A polymorphic hold is simply a browser hold that lures you to instal it with 1 advertised benefit, but past morphs into a antithetic hold that convincingly portrays itself arsenic 1 of the morganatic extensions you've already installed (e.g., your password manager). From a societal engineering perspective, it bears a beardown resemblance to phishing and smishing. In 1 of 2 archetypal forms that the onslaught tin take, it evades detection by temporarily disabling the morganatic hold without uninstalling it.

Also: I clicked connected 4 sneaky online scams connected intent - to amusement you however they work

On archetypal blush, the thought that 1 browser hold could beryllium truthful disruptive to different hold sounds similar the benignant of bundle bound usurpation immoderate tenable browser should artifact arsenic a portion of its information architecture. Take Chrome: When a browser hold is archetypal added to the Chrome Web Store, the developer indispensable state a manifest of permissions that end-users are warned astir earlier that hold tin beryllium installed.

For example, according to Google's database of permissions that developers tin see successful their manifests, if a developer declares that an hold needs entree to Chrome's notifications API, the substance "Display notifications" volition automatically beryllium included successful the preinstallation warning seen by users, arsenic shown successful the screenshot below:

According to Ramachandran, the database of permissions is excessively analyzable for regular users to marque an informed decision, frankincense expanding the likelihood that a menace histrion mightiness get support for an all-seeing, all-knowing browser "superpower."

Several of the permissions that suffice arsenic superpower permissions are ones that astir Chrome extensions, including password managers, shouldn't beryllium asking for. One of those -- the support for Chrome's chrome.management API (with Firefox, it's the browser absorption API) -- is the support that affords 1 hold the close to manipulate different extensions.

Also: How AI volition alteration cybersecurity successful 2025 - and supercharge cybercrime

An hold could inquire for this support erstwhile it's archetypal installed, oregon during a consequent update. Either way, erstwhile the developer manifest includes the chrome.management API, the idiosyncratic is presented with the substance "Manage your apps, extensions, and themes" arsenic shown successful the screenshot above.

But there's nary red-flag informing that indicates you're astir to alteration the extension's developer with a unsafe superpower.

"It mightiness consciousness similar getting support for the chrome.management API is simply a gangly order, and that an hold that asks for it mightiness necessitate immoderate dense vetting by Google," Ramachandran told ZDNET. "But this is not the case. Developers tin inquire for this support successful the manifest erstwhile uploading their extensions to the Chrome Store. So, information successful this lawsuit depends wholly connected the idiosyncratic knowing that this is simply a problematic superpower permission."

Once the developer of an hold has entree to the chrome.management API, not lone tin they morph their ain hold into thing else, they tin disable different ones and unpin them from the browser's toolbar without detection by the user. In fact, entree to the chrome.management API besides gives hackers the quality to afloat uninstall different extensions.

Also: 5 browser hold rules to unrecorded by to support your strategy safe

However, according to the chrome.management API documentation, if 1 hold uninstalls different extension, the idiosyncratic is notified with a pop-up dialog that can't beryllium overridden. Such a dialog would fundamentally extremity disconnected the idiosyncratic to the information that something's amiss. That's 1 crushed why, successful the polymorphic hold attack, the malware hold stealthily falls abbreviated of wholly uninstalling the morganatic hold it aims to temporarily instrumentality the spot of.

Instead [as shown successful the series of screenshots below], to implicit the ruse, a polymorphic hold replaces the morganatic extension's icon (where it was pinned successful the browser's toolbar) with a doppleganger that, if clicked, activates the polymorphic extension. The archetypal screenshot shows the 2 extensions pinned to Chrome's toolbar. Circled successful bluish is the icon for the morganatic 1Password extension. Circled successful reddish is the icon for the malicious hold that the idiosyncratic downloaded and pinned nether the pretense that it delivered immoderate different utile value.

Once the malicious hold detects that the idiosyncratic is astir to log into a website (which lone requires the quality to analyse the contents of the existent web page), it uses the chrome.management API to disable the morganatic hold and unpin its icon from Chrome's toolbar, arsenic shown below.

Then, arsenic shown below, the malicious hold changes its ain icon to look similar the 1 that belongs to 1Password.

By this point, the polymorphic hold volition person morphed into an hold that looks and feels similar the morganatic hold (reminiscent of however phishing websites impersonate morganatic sites). From there, the malicious hold prompts the unsuspecting idiosyncratic for the credentials to their 1Password relationship (remember, it could beryllium any password manager) and phones location to the hacker with the recently exfiltrated information.

Then, to cleanable up aft itself, it re-enables the morganatic extension, restores the pinned icons to their archetypal state, and adjacent completes the sign-in process with immoderate website the idiosyncratic was authenticating with.

In lawsuit the polymorphic hold is incapable to garner the user's support for entree to the chrome.management superpower, Ramachandran says there's a contingency program wherever it tin conscionable arsenic easy popular up a browser model that looks and feels a batch similar 1 of your morganatic extensions.

Also: How to support yourself from phishing attacks successful Chrome and Firefox

"All the attacker would person to bash is inject codification into the page, which creates a pop-up resembling the UI of the password manager extension," said Ramhachandran. "It would instrumentality a blase idiosyncratic to recognize this is not being served by the existent extension."

Injecting codification into the existent web leafage is different behaviour that, connected archetypal blush, sounds similar a privilege nary hold should have. But arsenic it turns out, beauteous overmuch each extensions -- particularly password managers -- request support to work and constitute to the progressive browser tab successful bid to bash what they do.

At the infinitesimal a website is asking for a idiosyncratic ID and password, a password manager has to work the leafage to find the idiosyncratic ID and password fields, and past indispensable autofill those fields with the due credentials successful bid to implicit the login process. When an hold needs these permissions -- arsenic LastPass and different password managers bash -- the preinstallation informing volition enactment that the hold tin "read and alteration each your information connected each websites," arsenic shown successful the partial screenshot below.

Is the polymorphic hold menace existent oregon nary large deal?

First, it's important to recognize that information companies similar SquareX person to ideate and past animate definite attacks successful bid to thrust request for their solutions. If SquareX tin show the plausibility of assorted attacks that haven't happened yet and beryllium that its solutions tin support against those attacks, it shouldn't beryllium hard to get immoderate IT professionals to put successful its solutions.

In this case, SquareX has imagined a script that, for idiosyncratic users, is mostly predicated connected a operation of ill-advised mistakes. For example, the onslaught is lone imaginable aft a idiosyncratic is duped into installing malware -- oregon possibly it should beryllium called morphware.

Also: How AI agents assistance hackers bargain your confidential information - and what to bash astir it

Despite efforts by Google to support the Chrome Web Store escaped of malware, LastPass Cyber Threat Intelligence Analyst Stephanie Schneider told ZDNET that "a 2023 study recovered that extensions containing malware were disposable connected the Chrome Web Store for an mean of 380 days. In 1 case, an hold remained disposable from December 2013 until it was removed successful June 2022." However, Schneider added, "Despite these reported instances, Google stated successful 2024 that little than 1% of each installs from the Chrome Web Store were recovered to see malware."

What are the implications for consumers versus businesses?

When it comes to idiosyncratic users, the much convincing mentation of the onslaught -- the 1 that looks and feels similar the morganatic hold -- requires the idiosyncratic to springiness the imposter hold the equivalent of superuser privileges. While we cannot wholly regularisation retired Ramachandran's contingency script involving a modular browser pop-up arsenic an alternate vector for this attack, successful our opinion, it is much apt to gully the user's suspicion that something's amiss. Either way, fixed the astonishing grade to which end-users proceed to beryllium socially engineered by phishers and smishers, either script is plausible.

For businesses and enterprises, the onslaught is predicated connected 1 of 2 imaginable scenarios. In the archetypal scenario, users are near to marque their ain decisions astir what extensions are loaded onto their systems. In this case, they are putting the full endeavor astatine risk. In the 2nd scenario, idiosyncratic successful an IT relation with the work of managing the organization's approved browser and hold configurations has to beryllium dormant astatine the wheel. The full constituent of centrally managing an organization's systems is to marque definite unauthorized and unvetted bundle doesn't someway find its mode onto the firm network.

6 reasons wherefore this menace is simply a large deal

The net is afloat of mendacious alarms astir information vulnerabilities that are made to dependable similar they request your contiguous attraction erstwhile they don't. But, this is simply a lawsuit where:

The modulation from passwords to passkeys volition effect successful astir of america utilizing a password manager, whether we privation to oregon not.
Threat actors are hellhole bent connected breaking into your password manager.
An overwhelming bulk of password manager users volition instal their password manager's browser extension.
Most end-users person anemic moments erstwhile they click connected different suspicious links oregon download malicious software.
The prime of operating strategy (Windows versus Mac) is irrelevant. Browsers are similar virtual machines to the grade that they see their ain Javascript and WebAssembly execution platforms.
The password manager solution providers that ZDNET spoke to each hold that, though the polymorphic hold onslaught presented by SquareX is presently a hypothetical onslaught (no known instances successful the chaotic person been reported), it poses a morganatic menace to their browser extensions.

In different words, this is an onslaught -- not needfully a vulnerability -- that merits further attraction and vigilance connected behalf of end-users and businesses. As such, here's our proposal connected however to champion support yourself.

How to support yourself against a malicious extension

1. Only instal extensions from the Chrome Web Store from trusted publishers

Browser extensions are fundamentally the downloadable EXEs (executable files) of the browser world. "Just similar you would not download and tally EXEs which are untrusted oregon from random sources, the aforesaid level of discretion needs to beryllium applied to browser extensions," said SquareX's Ramachandran. "Only instal extensions from the Chrome Web Store and marque definite they are extensions from trusted publishers. You tin find this retired by looking astatine the developer email code domain."

NordPass' Degutis suggested taking things a measurement further: "Googling a developer oregon the hold itself is really a precise safety-conscious idea."

Also: How Malwarebytes' information tools tin assistance companies halt online scams earlier it's excessively late

Another bully root of hold accusation is the Chrome Web Store's comments section, said Ramachandran. "Extensions with a past of atrocious behaviour mostly are reported. Especially beryllium cautious of extensions which advertise entree to nonrecreational versions of different third-party sites (e.g., AI extensions which advertise entree to the latest nonrecreational variation of ChatGPT)."

2. Learn wherefore definite permissions are requested

Educate yourself connected the types of permissions that mightiness convey browser superpowers to an hold that doesn't request them. LastPass's Schneider said, "Unsurprisingly, suspicious extensions mostly inquire for much permissions than harmless ones. Only usage extensions from reputable sources that explicitly authorities wherefore definite high-level permissions are required."

It's intolerable to gully a enactment successful the soil betwixt permissions that are universally innocuous and permissions that could airs a threat. For example, the "Read and alteration each your information connected each websites" support is required for a password manager hold to work, but not needfully required for different extensions. We deliberation reputable sources should explicitly authorities the reasons for each requested permission. After all, wherefore not?

3. Look for typos

Study the descriptions of extensions cautiously and look for typos earlier downloading them. Threat actors are notoriously atrocious spellers. In immoderate cases, a keyword mightiness beryllium misspelled successful bid to evade instrumentality detection. For example, "Before downloading immoderate extension, marque definite that the developer is really "OpenAI" not "OqenAI," advised Degutis.

4. Use multifactor authentication

Leverage multifactor authentication, advises 1Password's CTO Pedro Canahuati. This advice, peculiarly erstwhile it comes to authenticating with your password manager, cannot beryllium overstated.

Also: Why multi-factor authentication is perfectly indispensable successful 2025

In SquareX's hypothetical scenario, the malicious hold uses a dialog that looks and feels similar 1Password's hold to punctual the idiosyncratic for their 1Password idiosyncratic ID and password. However, if your password manager (or immoderate different extension) tin beryllium configured to authenticate with a passkey (as it should be), determination should beryllium a mode to debar entering your password for your password manager into any hold (the password manager's morganatic hold oregon that of a malicious polymorphic imposter's).

Shown beneath is an illustration of however Bitwarden's Chrome hold for its namesake password manager gives users the enactment of a passkey-driven login that's completed with the assistance of different instrumentality (e.g., a smartphone) that itself is logged into the user's Bitwarden account. If a malicious polymorphic hold presented a facsimile of this dialog and the idiosyncratic picked "Log successful with device," the full workflow would travel to a screeching halt due to the fact that the menace histrion has nary mode to determination the idiosyncratic to the workflow's adjacent step. (At that point, the idiosyncratic should admit they mightiness beryllium dealing with an illegitimate extension.)

However, successful presumption of further factors of authentication, users should beryllium cautious astir having one-time passcodes (OTPs) sent to an email inbox that's unfastened successful 1 of their browser tabs. An hold with the communal support to "Read and alteration each your information connected each websites" could theoretically intercept an OTP that appears connected that tab.

5. Review your installed extensions periodically

NordPass' Degutis besides suggests periodic reviews of your installed extensions: "Check your installed extensions astatine chrome://extensions/ and region immoderate you don't admit oregon nary longer use." At the precise least, reappraisal their permissions to spot if they inactive align with your consciousness of the extension's functionality and the permissions indispensable to alteration that functionality.

6. Study the behaviour of installed extensions

Better familiarize yourself with their idiosyncratic interfaces, which could assistance you to amended admit erstwhile an hold -- oregon an impostor -- is doing thing unexpected.

7. Opt successful to your browser's enhanced safe-browsing feature

When modular safe-browsing is selected, Chrome "protects against sites, downloads, and extensions that are known to beryllium dangerous." Under modular protection, you whitethorn get a informing astir 1 of your installed extensions if Google learns of its malicious quality immoderate days, weeks, oregon months aft you installed it.

However, Chrome's enhanced harmless browsing, arsenic shown successful the partial screenshot below, "sends the URLs of sites you sojourn and a tiny illustration of leafage content, downloads, hold activity, and strategy information" to Google's AI-powered information services. It's hard to cognize precisely what Google means by "extension activity." (Google has not yet responded to ZDNET's questions astir polymorphic extensions.)

Also: That weird CAPTCHA could beryllium a malware trap - here's however to support yourself

But NordPass's Degutis told ZDNET that "in this mode, Google AI is scanning websites and downloads (including extensions) against known and emerging threats." Conceivably, present that Google is alert of the polymorphic hold threat, its information models person been trained to look for a operation of polymorphic behaviors, specified arsenic 1 hold momentarily disabling different hold portion changing its ain icons.

Note: When enhanced safe-browsing is activated, Chrome is sending "more accusation astir your enactment to Google successful existent clip to connection stronger, much customized protection," according to a Google enactment page. "This accusation includes the URLs you sojourn and a tiny illustration of leafage content, downloads, hold activity, and strategy information. Some information features are disabled successful incognito to forestall revealing further information to Google." In different words, Google is unquestionably collecting much accusation astir what you're doing successful Chrome erstwhile enhanced harmless browsing is activated. But it's not wide however that changes for an incognito session. Users and organizations indispensable determine for themselves whether specified privateness trade-offs are worthy the enhanced protection.

What should organizations do?

Businesses and different enterprises should amended themselves and their users connected the imaginable dangers of polymorphic extensions. If organizations aren't centrally managing the configuration of each web browsers connected each end-user systems, present is simply a bully clip to start. Ramachandran suggested converting "your browsers to managed browsers and guarantee that lone whitelisted extensions tin beryllium installed."

Additionally, an IT manager tin enforce respective of the options mentioned supra for individuals done the centralized browser absorption console.

LastPass' Schneider told ZDNET:

"Organizations should besides see menace modeling exercises that code the extensions they let connected firm devices to person a broad knowing of what it really does (versus what it says it does) and the imaginable threats associated with extensions' permissions if it were utilized for malicious purposes. I'm not saying these morganatic extensions would needfully beryllium utilized for those purposes. But, they should beryllium evaluated from the position of 'If this were a malicious extension, what would it beryllium capable to do, and what would the consequences to the concern be?'"

Also: Why nary tiny concern is excessively tiny for hackers - and 8 information champion practices for SMBs

Degutis suggested that organizations should "install endpoint extortion oregon browser information tools that tin observe malicious extensions."

SquareX's Ramachandran was not shy astir suggesting SquareX's endeavor solutions that, among different things, tin artifact the installation of extensions based connected the permissions they require.

What should browser makers similar Google do?

When it comes to policing the Chrome Web Store, Google is successful a tricky position. Unfortunately, Google cannot forestall each extensions from accessing definite superpower browser APIs. Whereas definite morganatic extensions request entree to these alleged superpowers, those aforesaid powers should beryllium of nary usage to different extensions. Meanwhile, mean users are often near with the intolerable task of making a determination astatine the infinitesimal an hold is being installed.

Also: Best VPN services: How the fastest and astir unafraid VPNs stack up

Throughout the developer documentation for Chrome, Google routinely advises developers to lone necessitate those permissions that are minimally needed for the halfway functionality of their extensions portion giving users the prime of approving optional permissions successful bid to alteration an extension's further capabilities. On a page that describes Chrome's Permissions API, Google says, "The Permissions API allows developers to explicate support warnings and present caller features gradually, which gives users a risk-free instauration to the extension."

The wide thought is to commencement hold users disconnected with 1 acceptable of permissions and gradually exposure them to caller features that mightiness necessitate further permissions on the way. For that circumstantial workflow, Google provides an illustration (shown below) of however an hold tin inquire for further permissions.

Although the illustration doesn't amusement it (we deliberation it should), this would person been the cleanable accidental for the illustration hold to explicate (as Google suggests) the intent of the further support petition (maybe with substance that appears successful the copious whitespace). When users click connected a fastener similar the 1 shown above, it triggers 1 of Chrome's modular permissions dialogs, arsenic shown successful the illustration below.

Apart from the existent permissions successful the list, the dialog is astir the aforesaid format arsenic the dialog that users spot erstwhile they instal an hold successful the archetypal place. So, what's incorrect with this picture?

The messaging successful the illustration supra and others similar it is excessively ambiguous. For example, it's intolerable to cognize if the hold volition cease to relation altogether if the idiosyncratic clicks "Deny." Likewise, it's not wide if clicking "Allow" volition assistance the requested support connected a impermanent oregon imperishable basis. After all, person we not been trained by Zoom and different conferencing products to assistance entree to our cameras and microphones for immoderate conferences and not others? Judging by the beingness of the "Remove()" method arsenic portion of Chrome's Permissions API, there's nary crushed a developer couldn't petition a support temporarily and past region it erstwhile the idiosyncratic nary longer needs it.

Also: A whopping 94% of leaked passwords are not unsocial - volition you radical ever learn?

But what's truly incorrect with Google's illustration workflow is that it's purely optional. Instead, hold developers tin inquire for arsenic galore permissions arsenic they privation astatine the clip that an hold gets installed. In that workflow, determination is nary accidental that we cognize of for developers to modify Chrome's modular dialogs to either connection a justification for each requested support oregon to springiness users the enactment of disallowing optional permissions.

We're imagining thing with the benignant of fidelity offered by a cooky consent signifier similar the 1 pictured beneath from the website for Ireland's Grand Opera House.

Some permissions could beryllium tagged arsenic necessary, others arsenic optional, and users could toggle them connected oregon disconnected based connected their knowing of the mentation and their expectations of the extension's functionality.

If and erstwhile Google responds to our requests for comment, we'll update this story.

Stay up of information quality with Tech Today, delivered to your inbox each morning.

Read Entire Article