Scammers Are Using Fake Google Security Checks To Steal User Passwords, Reports Find

Cybersecurity: Browser-Based Surveillance Toolkit Identified

A malicious website imitating a Google Account security page has been identified as distributing an advanced browser-based surveillance toolkit. This toolkit, analyzed by Malwarebytes, masquerades as a routine security check, prompting users to verify their accounts.

The attack leverages social engineering rather than exploiting any browser vulnerabilities. Victims are led through a process that grants the attackers access to push notifications, contacts, GPS location, and clipboard data without needing a traditional app installation.

The toolkit operates as a Progressive Web App (PWA). Upon installation, it disguises itself as a native Google app by removing the browser's address bar. Permissions for notifications are framed as security alerts, and the Contact Picker API is used to request access to contacts. These contacts are transmitted to a server controlled by the attackers. Location data is also collected under the pretense of identity verification.

Once equipped, the toolkit employs two pieces of code. The first monitors clipboard activity and attempts to capture one-time passwords via the WebOTP feature. It continuously communicates with the attackers' server every 30 seconds. The second, a service worker, operates in the background, enabling persistent surveillance even when the app is not actively displayed. It can store stolen data offline and transmit it when an internet connection is re-established.

Additionally, the toolkit can transform a user's browser into a proxy using a WebSocket relay, enabling attackers to make web requests as if originating from the victim's device. It can also perform network scans and execute JavaScript on local devices, effectively granting remote control within the browser environment.

If users follow all prompts, the web layer delivers an Android APK under the guise of a security update. The APK, named com.device.sync, requests extensive permissions, including SMS, call logs, microphone access, and more. It incorporates a custom keyboard for keystroke logging and registers as a device administrator to hinder removal.

It is essential to note that Google does not conduct security checks via random pop-up pages. Legitimate security tools are accessible only through myaccount.google.com .

To mitigate risks, users who may have installed the PWA should uninstall it, unregister associated service workers, and revoke notification permissions. On Android, users should identify and remove the app named System Service with the package com.device.sync, ensuring device administrator access is revoked first. It is also advisable to change passwords for accounts where SMS-based two-factor authentication was used during the compromise period and to review autofill and notification settings.

Conducting a scan with reputable mobile security software is recommended for further protection.

Based on reporting by techround.co.uk.