Bitwarden Fraudulent Organization Injection via Account Recovery Abuse
Detects events that may indicate a user is being enrolled into a Bitwarden organization's account recovery policy under malicious circumstances. As described by researchers, a malicious or compromised server can silently add a user to an attacker-controlled organization and enable an account recovery policy. The victim's client will then encrypt the user's vault key with an attacker-provided public key and upload it, leading to a full vault compromise.
Sigma
