⚠ DEMO 04 — Password Manager Overlay | Authorized research only

PASSWORD MANAGER OVERLAY

UI REDRESSING · PM ABUSE

Attacker renders a fake password-manager dropdown beneath the real input. Users click the malicious entry believing it is Chrome/Bitwarden autofill — credentials route to attacker.

[ LIVE STAGE — click malicious entry ]
🔑 [email protected] — corp.portal.com
⚠ [email protected] — corp.portal.com
[*] Click either dropdown entry to simulate autofill selection...
Defense: Password managers should pin dropdowns to extension UI; users verify domain in autofill prompts.