The FireAI Security Blog

By FireAI Security & Research Team · Published

“Install as App” Phishing: When a Website Pretends to Be Software

“Install as App” Phishing: When a Website Pretends to Be Software

Chromium-based browsers let a user turn almost any web page into what looks like a native app: its own window, its own Dock icon, no visible browser chrome. That feature is meant for legitimate sites you use often. Security researcher mr.d0x documented, on 11 June 2024, how the same mechanism can be turned into a phishing kit: install a page as an app, then draw a fake browser window, address bar and all, inside the app’s own HTML.

How the installed-app illusion is built

In the documented technique, a victim is led to a page that prompts them to install it as an app, with the install prompt itself showing a spoofed name such as “Microsoft Login.” Once installed, the app opens in its own chrome-less window. Because there is no real address bar to spoof, the page draws its own with CSS: a convincing fake, positioned exactly where a browser’s address bar would be, showing whatever URL the attacker wants displayed. To someone who has been trained to “check the address bar,” the app appears to pass that check, because what they are looking at is not the browser’s address bar at all.

What actually makes this convincing

  • It installs like normal software: an icon in the Dock or Applications folder, its own window, sometimes push notifications, none of which requires leaving the browser’s own install flow.
  • The install prompt’s name and icon are whatever the attacker’s manifest declares them to be. Nothing about the install step verifies that the name matches the site.
  • Once running, the fake chrome persists for the life of the session: no browser tabs, bookmarks bar or extension icons to break the illusion.

Auditing what is actually installed, from the terminal

On macOS, Chrome and Chromium-based browsers install these “apps” as ordinary application bundles, and each one records the real URL it was installed from inside its own Info.plist, whatever name is shown in Finder. We confirmed this against a real, currently installed app on this Mac (a browser-installed shortcut to a Cloudflare dashboard):

Terminal
ls ~/Applications/*.localized/
Cloudflare.app

plutil -p ~/Applications/"Brave Browser Apps.localized"/Cloudflare.app/Contents/Info.plist | grep -i CrAppMode
  "CrAppModeShortcutName" => "Cloudflare"
  "CrAppModeShortcutURL" => "https://dash.cloudflare.com/"

That CrAppModeShortcutURL field is the fact a fake address bar cannot alter: it is set once, at install time, from the page’s own manifest, and it is what the app actually opens every time it launches. An app named “Bank Login” whose CrAppModeShortcutURL points somewhere other than your bank’s real domain has told on itself.

  1. List every installed web app: ls ~/Applications/*.localized/*/, once per Chromium-based browser you use (Chrome Apps.localized, Brave Browser Apps.localized, Edge Apps.localized, and similar).
  2. For anything you do not clearly remember installing, or that handles a login, check its real URL: plutil -p "<path>/Contents/Info.plist" | grep -i CrAppMode.
  3. Watch for the true origin Chromium briefly shows when the app opens, and read it, rather than the app’s own drawn interface.

Why this is a network problem, not just a UI one

Whatever the window looks like, a credential-harvesting page still has to send what it collected somewhere, over the network, from a process running on your Mac. A firewall that only asks “is this app’s binary signed and trusted” cannot help here: an installed PWA runs inside the browser’s own signed, trusted executable. What can help is watching the connection itself: which process is making it, and where it is actually going, independent of what the window on screen claims to be.

How FireAI and HisnLabs fit in

Whatever a fake login screen looks like, it still has to send the password it captured somewhere; FireAI shows you exactly which process is trying to phone home and to what destination, installed web app or not, and lets you say no before anything leaves your Mac.

FireAI is HisnLabs’ own product: an on-device AI firewall for Mac. It shows every connection your apps make, in plain language, and lets you decide what leaves your Mac — its AI runs locally, so your traffic is never sent to us or anyone else. HisnLabs’ security research team is the group that keeps that decision-making accurate: cataloguing which domains are ordinary telemetry versus a real product, tracking the country and network behind a connection, and training the on-device model (its Autopilot feature) on real traffic patterns, all without any of it leaving your Mac.

You can read the technical decisions behind it, or try FireAI for 17 days, at FireAI, by HisnLabs.

Sources