DOM/iFrame based Clickjacking via XSS dumps Password Manager Credentials
Identifies devices with vulnerable versions of popular password manager browser extensions installed and active. These versions are susceptible to credential theft via DOM manipulation by malicious web pages. Note: This is potential for false positives; the exploit is Client-side, out of reach for traditional detection. The detection will only validate vulnerable versions for the following password manager vendors who have not remediated all the vulnerabilities in the report by researcher Marek Tóth.
Microsoft Sentinel (KQL)
