Def Con 33 warns of broad password managers clickjacking risk

Def con 33 attendees were told that a broad set of widely used password managers remain vulnerable to unpatched clickjacking techniques that could expose credentials, authentication codes, and payment data. Independent researcher Marek Tóth demonstrated how attackers could exploit the autofill features of browser-based password managers by overlaying invisible UI elements, prompting users to interact with hidden fields, and then draining sensitive information from the forms. The findings, verified by a cybersecurity firm that helped coordinate disclosure with vendors, involve 11 major password managers and affect tens of millions of users. Some vendors have since released patches; others have acknowledged the risk or provided partial fixes, leaving a window of exposure for many users.

The attack hinges on what researchers describe as DOM-based and UI redressing techniques. An attacker places a malicious page or compromises a legitimate site and uses CSS opacity changes, overlays, or pointer events to render the password manager’s autofill prompts effectively invisible. A crafted overlay, such as a fake cookie banner or CAPTCHA, directs the user’s clicks to the hidden autofill...