Security News > 2022 > October > Hackers Can Use 'App Mode' in Chromium Browsers' for Stealth Phishing Attacks

In what's a new phishing technique, it has been demonstrated that the Application Mode feature in Chromium-based web browsers can be abused to create "Realistic desktop phishing applications."
Application Mode is designed to offer native-like experiences in a manner that causes the website to be launched in a separate browser window, while also displaying the website's favicon and hiding the address bar.
"Although this technique is meant more towards internal phishing, you can technically still use it in an external phishing scenario," mr.
This is achieved by setting up a phishing page with a fake address bar at the top, and configuring the -app parameter to point to the phishing site hosting the page.
On top of that, the attacker-controlled phishing site can make use of JavaScript to take more actions, such as closing the window immediately after the user enters the credentials or resizing and positioning it to achieve the desired effect.
The findings come as new findings Trustwave SpiderLabs show that HTML smuggling attacks are a common occurrence, with.
News URL
https://thehackernews.com/2022/10/hackers-can-use-app-mode-in-chromium.html
Related news
- Microsoft: Hackers steal emails in device code phishing attacks (source)
- Chinese hackers targeted sanctions office in Treasury attack (source)
- Malicious Browser Extensions are the Next Frontier for Identity Attacks (source)
- Hackers exploit critical Aviatrix Controller RCE flaw in attacks (source)
- Hackers use FastHTTP in new high-speed Microsoft 365 password attacks (source)
- Ransomware gangs pose as IT support in Microsoft Teams phishing attacks (source)
- Microsoft Teams phishing attack alerts coming to everyone next month (source)
- New Apple CPU side-channel attacks steal data from browsers (source)
- Google says hackers abuse Gemini AI to empower their attacks (source)
- How to Prevent Phishing Attacks with Multi-Factor Authentication (source)