Hackers are abusing them again Google Ads To take unsuspecting users to phishing sites but this time, they set their sights on bitwarden and other password managers.
with one of the The best password managersYou can securely store all your login credentials in one place and even generate new, strong, and complex passwords with the built-in password generator tools. However, with all this sensitive data in one place, this makes password managers an ideal target for cybercriminals.
Next to KeePass Which stores your passwords locally, most password managers are cloud based so you can access your passwords through their websites or mobile apps. Bitwarden and other password managers store your passwords in a password vault where they are encrypted and you need to use your master password to decrypt them.
Now, though, it appears that hackers are using fake ads on Google search to lead Bitwarden users to disguised-looking phishing sites with the intent of stealing their password vaults.
Why you shouldn’t click on the first results in a Google search
According to a new report from PC (Opens in a new tab)Bitwarden users started seeing an ad titled “Bitward – Password Manager” in Google search results when searching for “bitwarden password manager” earlier this week.
Then they took to the Reddit and Bitwarden forums trying to warn others. While some could easily figure out that the ad led to a phishing site due to the fact that the domain was “appbitwarden.com” instead of just “bitwarden.com”, many users ended up clicking on it. This redirected them to “bitwardenlogin.com”.
This phishing website has been carefully designed to look like an exact replica of Bitwarden’s actual Web Vault login page. In its testing, BleepingComputer found that the site accepted user credentials but once submitted, would redirect them to Bitwarden’s official login page. To make matters worse, the phishing site also attempted to steal MFA-supported session cookies or authentication tokens for full access to Bitwarden’s user password vault.
Bitwarden isn’t the only password manager targeted by fake ads, such as MalwareHunterTeam (Opens in a new tab) I recently discovered that criminals have resorted to targeting fake Google ads 1 password users.
Ads are an important part of the online ecosystem, and without them, we wouldn’t have Google Search, Gmail, Google Docs, or any of the search giant’s other online productivity tools. But do He should think twice Before clicking any search engine ads as they may lead to phishing sites. Since anyone can buy an ad online, so can hackers. Although Google performs strict security checks on its ads, bad ads manage to slip through the cracks from time to time.
For this reason, you should always scroll past the first results on Google search because they are usually advertisements. Bitwarden websites and the actual websites of other companies appear at the bottom of the search results. Clicking the first result you see may seem normal but you might be putting yourself at risk by doing so.
How to protect the credentials stored in your password manager
If you use a password manager, you need to make sure that you take extra steps to protect the passwords stored in your vault. The first one is to enable multi-factor authentication (MFA) so that a hacker needs your password and something else to access your account.
Once, SMS codes It may be a common form of authentication but it is actually not secure since an attacker could use it sim swap to hijack your icons. Authentication apps like Google Authenticator are way better and not that hard to use. Meanwhile, physical Security keys is the best way to protect your accounts, but it can be a hassle.
At the same time, you want to make sure you’re using a The best antivirus software To protect your computer, the The best antivirus for Mac To protect your Mac and Best antivirus apps for Android To protect your Android smartphone. For those who are highly concerned about security and are more vulnerable than others, you may also want to invest in The best identity theft protection These services can help you recover from fraud as well as recover your identity if it has been stolen online.
Password managers are great, but you may not need one now that Google, Apple, Microsoft, and other tech giants are pushing passkeys as an alternative to passwords. However, until then, you should be careful when you click on them even if you are using a legitimate search engine.
