Full Report
Phishing using PWAs? ESET Research's latest discovery might just ruin some users' assumptions about their preferred platform's security
Analysis Summary
# Tool/Technique: PWA Phishing Campaign
## Overview
This refers to a recently discovered, uncommon phishing campaign utilizing **Progressive Web Apps (PWAs)** to deceive users on both Android and iOS platforms. The technique leverages the PWA installation process, enhanced by native system prompts, to install a malicious application that mimics a genuine application, targeting clients of a prominent Czech bank.
## Technical Details
- Type: Technique (Phishing leveraging PWA deployment)
- Platform: Android, iOS
- Capabilities: Allows installation of a "phishing application" from a third-party website without explicit permission for third-party app installation; uses native system prompts to enhance perceived legitimacy.
- First Seen: August 2024 (Based on article date and discovery mention)
## MITRE ATT&CK Mapping
The primary focus is on deception and initial access/persistence mechanisms:
- T1566 - Phishing
- T1566.001 - Spearphishing Attachment (If delivered via a specific link/message)
- TA0001 - Initial Access
- T1189 - Drive-by Compromise (If the site forces the download/prompt)
- TA0003 - Persistence (If the PWA/installed artifact maintains access)
## Functionality
### Core Capabilities
- Utilizing PWAs as a delivery vector, which are perceived by users as fully functional, standalone applications.
- Deceptive installation process on Android that can result in the "silent installation of a special kind of APK," appearing to originate from the Google Play Store.
- Leveraging native system prompts to reinforce the legitimacy of the installation action for the user.
### Advanced Features
- Bypass user assumptions regarding app store control: On iOS, this may break assumptions about platform security controls.
- Android artifact impersonation: The resulting APK on Android is customized to appear as if it was installed from the official Google Play store.
## Indicators of Compromise
*Note: Specific IoCs were not detailed in the context provided, only the context of the attack.*
- File Hashes: [Not specified]
- File Names: [Not specified, likely mimics branding of the targeted bank]
- Registry Keys: [Not specified]
- Network Indicators: [Not specified, likely involves domains hosting the PWA landing page]
- Behavioral Indicators: Execution of native system prompts related to "Add to Home Screen" or application installation requests originating from non-official sources.
## Associated Threat Actors
- Attackers targeting clients of a prominent Czech bank.
- General threat actors seeking to use legitimate web technologies (PWAs) for sophisticated phishing operations.
## Detection Methods
- Signature-based detection: Limited for novel PWA exploits; requires updates for specific phishing site signatures.
- Behavioral detection: Monitoring for unusual system prompts related to application installation originating from web contexts being accepted by the user.
- YARA rules: [Not available in context]
## Mitigation Strategies
- User Education: Highlighting that PWAs, while convenient, can be used for phishing and that users should verify the source domain carefully.
- Security Auditing: Reviewing recent system prompts asking to install applications from recently visited websites.
- Mobile Endpoint Protection: Maintaining up-to-date mobile security solutions capable of evaluating application installations even when they bypass traditional app store scrutiny.
## Related Tools/Techniques
- Traditional Mobile Phishing Campaigns
- Browser-in-the-Middle (BITM) phishing pages (if the PWA loads a fake login screen)
- Social engineering techniques used to prompt users to "Add to Home Screen."