Researchers have discovered that Google Chrome’s Utility Mode could be abused for phishing threats.

Used to supply ChromeOS customers a clear, minimal interface for sure web sites resembling YouTube, when launched, Utility Mode brings up a brand new browser window with out the deal with bar, toolbars, or different acquainted parts – even the taskbar shows the web site favicon as an alternative of the Chrome icon.

However this mode could be abused, cybersecurity researcher mr.d0x found. If an attacker manages to persuade a consumer to run a Home windows shortcut that runs a phishing URL with Chromium’s Utility Mode characteristic, the consumer will solely see what appears to be the login kind for an app. In actuality, although, it will be a phishing web page that steals (opens in new tab) individuals’s login information. 

Shortcut recordsdata 

Ever since Microsoft moved to kill malicious Workplace recordsdata, cybercriminals have been pivoting in the direction of Home windows shortcut recordsdata (.LNK). 

Cybersecurity specialists have since uncovered numerous assault campaigns that efficiently leveraged .LNK recordsdata to ship every kind of viruses and malware, from QBot, to BazarLoader, to something in between. 

Explaining this new potential methodology, mr.d0x says an attacker might use a shortcut file to launch a phishing “applet” on the sufferer’s endpoint: 

• For Chrome:
  “C:Program FilesGoogleChromeApplicationchrome.exe” –app=https://instance.com
• For Microsoft Edge
  “c:Program Recordsdata (x86)MicrosoftEdgeApplicationmsedge.exe” –app=https://instance.com

There are a number of methods to abuse this flaw, mr.d0x added, together with gaining access to the goal machine, utilizing a conveyable HTML file with the “-app” parameter embedded, or utilizing the Browser-in-the-Browser method so as to add a pretend deal with bar. Lastly, the assault can be pulled off on macOS and Linux units, he mentioned. 

• Try the very best endpoint safety (opens in new tab) companies round

Through: BleepingComputer (opens in new tab)