Forest Global Training Partners

Cyber Risks · Krebs on Security

Devious New Phishing Tactic Targets Tabs

Summary: Mozilla Firefox creative lead Aza Raskin demonstrated a phishing technique in which JavaScript on an open but unviewed tab silently rewrites that tab's page content, favicon and title to mimic a login page such as Gmail, without changing the address in the navigation toolbar. Researcher Aviv Raff later posted a proof-of-concept that morphs into a Gmail login image after the user switches tabs or after about 10 reloads, and a NoScript update on May 27 was released to block these tabnabbing attacks.

Bottom line: The attack works because users trust the favicon and title as a cue that a tab is the site they left open, so a credential prompt on a tab that was never logged out can harvest passwords and then redirect to the real Gmail, making the login appear successful. Raskin's proof-of-concept fooled Krebs himself mid-article, and Raff's version worked against Firefox even with NoScript in full paranoid mode.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related