Backdoored password manager stole data from as many as 29K enterprises - Passwordstate is an Enterprise Password Management solution

As many as 29,000 users of the Passwordstate password manager downloaded a malicious update that extracted data from the app and sent it to an attacker-controlled server, the app maker told customers.

In an email, Passwordstate creator Click Studios told customers that bad actors compromised its upgrade mechanism and used it to install a malicious file on user computers. The file, named “moserware.secretsplitter.dll,” contained a legitimate copy of an app called SecretSplitter, along with malicious code named "Loader," according to a brief writeup from security firm CSIS Group.

The Passwordstate breach underscores the risk posed by password managers because they represent a single point of failure that can lead to the compromise of large numbers of online assets. Well that is a worst-case scenario for many, especially happening on the client side. Always have a good master password and ensure you have 2FA turned on.

See Backdoored password manager stole data from as many as 29K enterprises

#technology #security #passwordmanager #hacked

Compromised update mechanism for Passwordstate pushes malware that steals data.

source https://gadgeteer.co.za/backdoored-password-manager-stole-data-many-29k-enterprises-passwordstate-enterprise-password