Convincing, Malicious Google Ads Look to Lift Password Manager Logins

Several users of Bitwarden's password management technology last week reported seeing paid ads to credential stealing phishing sites when they used Google to search for the official Web vault login page for the vendor.

Google says addressing the problem is a top priority.

The posts about the problem, on Bitwarden's community forum and on Reddit, prompted the vendor to warn its users about the threat and urge them to bookmark the correct URL for the Web vault. 

"Sometimes imposters will try and grab your attention if you use a search engine. Stay safe and secure," Bitwarden said in an official tweet.

Password Vault Phishing: A Growing Threat

The vendor's warning echoed one from 1Password last week that referenced the same threat to users of the company's password manager. "It's come to our attention that some websites are posing as 1Password," the vendor said. "Ensure that any link directs you to our website." 

The malicious ads targeting users of Bitwarden and 1Password continue a string of recent attacks on password managers. In December, for instance, LastPass, among the larger vendors in this space, disclosed a breach in which attackers accessed a backup copy of customer vault data, including usernames, passwords, and form-filled data. The December attack followed one from last August, where threat actors gained access to the company's source code. In another incident that came to light in January, attackers broke into systems at Norton LifeLock and accessed customer information that may have included passwords stored in Norton Password Manager.

Related:Fake Windows Updates Trick Users Into Installing Ransomware

Google Ads: A New Tactic 

The malicious advertisements targeting Bitwarden and 1Password customers suggest that threat actors have added another tactic to break into password managers and compromise accounts associated with those passwords.

The malicious ads that users of Bitwarden and 1Password reported last week surfaced high on top of Google's search engine results when the users searched for "bitwarden password manager," for instance, or for 1Password's Web vault. And the landing pages are high quality: One Bitwarden user reported finding a phishing website that impersonated the vendor's official Web vault so well that it was hard to tell the difference. 

Continue reading this article on Dark Reading