RedLine Malware Shows Why Passwords Shouldn’t be Saved in Browsers

The RedLine information-stealing malware targets popular web browsers such as Chrome, Edge, and Opera, demonstrating why storing your passwords in browsers is a bad idea.

This malware is a commodity information-stealer that can be purchased for roughly $200 on cyber-crime forums and be deployed without requiring much knowledge or effort.

However, a new report by AhnLab ASEC warns that the convenience of using the auto-login feature on web browsers is becoming a substantial security problem affecting both organizations and individuals.

In an example presented by the analysts, a remote employee lost VPN account credentials to RedLine Stealer actors who used the information to hack the company’s network three months later.

Also Read: In Case You Didn’t Know, ISO 27001 Requires Penetration Testing

Even though the infected computer had an anti-malware solution installed, it failed to detect and remove RedLine Stealer.

The malware targets the ‘Login Data’ file found on all Chromium-based web browsers and is an SQLite database where usernames and passwords are saved.

Even when users refuse to store their credentials on the browser, the password management system will still add an entry to indicate that the particular website is “blacklisted.”

While the threat actor may not have the passwords for this “blacklisted” account, it does tell them the account exists, allowing them to perform credential stuffing or social engineering/phishing attacks.

After collecting the stolen credentials, threat actors either use them in further attacks or attempt to monetize them by selling them on dark web marketplaces.

An example of how widely popular RedLine has become for hackers is the rise of the ‘2easy’ dark web marketplace, where half of all the sold data sold was stolen using this malware.

Another recent case of RedLine distribution is a website contact form spamming campaign that uses Excel XLL files that download and install the password-stealing malware.

Also Read: 4 Considerations In The PDPA Singapore Checklist: The Specifics

It’s like RedLine is everywhere right now, and the main reason behind this is its effectiveness in exploiting a widely-available security gap that modern web browsers refuse to address.

What to do instead

Using your web browser to store your login credentials is tempting and convenient, but doing so is risky even without malware infections.

By doing so, a local or remote actor with access to your machine could steal all your passwords in a matter of minutes.

Instead, it would be best to use a dedicated password manager that stores everything in an encrypted vault and requests the master password to unlock it.

Moreover, you should configure specific rules for sensitive websites such as e-banking portals or corporate asset webpages, requiring manual credential input.

Finally, activate multi-factor authentication wherever this is available, as this additional step can save you from account take-over incidents even if your credentials have been compromised.