While this may all sound like doom and gloom, the attack still requires a successful social engineering attempt to fool a user into running a malicious executable. As the cookies are stolen after the user has successfully authenticated with MFA, these stolen cookies will bypass MFA secured by one-time passwords or security keys, and will remain valid until the session expires or some other post-authentication check detects unusual behavior. These cookies can be used to refresh pages and be automatically authenticated to the site. Edge’s WebView2 also allows a developer to directly access cookies and inject JavaScript into the webpage that is loaded by an application, making it an excellent tool for threat actors to log keystrokes, steal authentication cookies and then send them to a remote server. In the new attack, the executable will open the legitimate Microsoft login form using the embedded WebView2 control requesting direct action from the victim. Using this technology, apps can load any website into a native application and have it appear as it would if you opened it in Microsoft Edge. Microsoft Edge WebView2 allows the user to embed a web browser with full support for HTML, CSS, and JavaScript, directly into native apps using Microsoft Edge (Chromium) as the rendering engine. The most recent of these methods, an executable called “WebView2-Cookie-Stealer,” has been created by cybersecurity researcher mr.d0x and can easily steal a user’s authentication cookies and log into stolen accounts, including accounts that are secured with MFA. Recent methods includ zero-day website vulnerabilites, reverse proxies, browser-in-the-browser attacks, and manipulating VNC to display remote browsers locally.

As businesses and end users continue to adopt multi-factor authentication methods, threat actors and researchers alike have been hard at work developing new and clever techniques to bypass these security controls.

Microsoft edge webview2 what is it