Phishing Technique Bypasses MFA With Microsoft Edge WebView2 Applications

Cybersecurity researcher mr.dox has developed a new phishing method that uses Microsoft Edge WebView2 applications to steal a user’s authentication cookies and log into stolen accounts, even if they are secured with MFA.

The new phishing technique, known as the WebView2-Cookie-Stealer consist of a WebView2 executable that opens the login of a legitimate website from inside the application.

Microsoft Edge WebView2 allows developers to embed a web browser directly into their native apps with Microsoft Edge. Microsoft Edge WebView2 allows apps to load any web page into a native application and make it look as if they have opened those applications in Microsoft Edge.

The new phishing POC opens the legitimate Microsoft login form using the embedded WebView2 control. It can be used to steal all cookies sent from the remote server after a user logs in, including authentication cookies.

For this purpose, the application creates a Chromium User Data folder at the first start and then uses this folder for each subsequent installation.

The attack also bypasses MFA, which are secured by OTPs or security keys. This is possible because the cookies are stolen after users have logged in and successfully solved the challenge of multi-factor authentication.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web