Hackers are once again exploiting Google ads to direct unsuspecting users to phishing sites, this time targeting Bitwarden and other password managers.

The best password managers allow you to securely store all your login information in one place and even generate new, strong, and complex passwords using the built-in password generator. However, because all sensitive data is in one place, password managers are a prime target for cybercriminals.

Other than KeePass, which stores passwords locally, most password managers are cloud-based and can access passwords from a website or mobile app; Bitwarden and other password managers store passwords in encrypted password vault and require the use of a master password to unencrypt them.

However, hackers now appear to be using fake Google search ads to direct Bitwarden users to convincing phishing sites with the goal of stealing password vaults.

According to a new report from BleepingComputer (opens in new tab), Bitwarden users were searching for "bitwarden password manager" earlier this week when a Google search result for "Bitward -. They began seeing ads titled "Password Manager.

They then posted on both Reddit and Bitwarden's forum to warn others. Because the domain was "appbitwarden.com" rather than just "bitwarden.com," some were able to easily see that the ad was directing them to a phishing site, but many users ended up clicking on it. As a result, they were redirected to a site called "bitwardenlogin.com."

The phishing site was carefully designed to appear to be an exact replica of Bitwarden's actual Web Vault login page, although BleepingComputer's testing indicates that the site accepts user credentials, Once the credentials are submitted, the user is redirected to Bitwarden's official login page. To make matters worse, the phishing site attempted to steal MFA-backed session cookies and authentication tokens to gain full access to the Bitwarden user's password vault.

Bitwarden is not the only password manager targeted by fake ads.

Advertising is an important part of the online ecosystem, and without advertising, Google Search, Gmail, Google Docs, and other online productivity tools from the search giant would not exist. However, before clicking on an ad in a search engine, one should think twice about the possibility that it could lead to a phishing site. Since anyone can buy ads online, hackers can as well. Google has strict security checks in place for ads, but malicious ads can occasionally slip through the cracks.

For this reason, the first results of a Google search are usually ads and should always be scrolled past; the actual sites of Bitwarden and other companies appear further down in the search results. While it may seem natural to click on the first search result you see, you may be putting yourself at risk by doing so.

If you are using a password manager, you need to make sure that you are taking additional steps to protect the passwords stored in your vault. The first of these is to enable multi-factor authentication (MFA), which means that hackers will need your password and something else to access your account.

One-time, SMS codes may be a common form of authentication, but they are not really that secure because attackers can use SIM swapping to hijack your codes. authentication apps like Google Authenticator, better method and are not that difficult to use. On the other hand, physical security keys are the best way to protect your account, but they are labor intensive.

At the same time, you want to make sure you are using the best antivirus software to protect your PC, the best Mac antivirus software to protect your Mac, and the best Android antivirus app to protect your Android smartphone. If you are security conscious and are more at risk than others, you may want to invest in the best identity theft protection. This is because these services can help you recover from fraud or get your identity back if it was stolen online.

Password managers are great, but with Google, Apple, Microsoft, and other tech giants promoting passkey as an alternative to passwords, you may not need one. But still, be careful where you click, even on legitimate search engines.