Click Studios, the company behind the Passwordstate enterprise password manager, notified customers that attackers compromised the app's update mechanism to deliver malware in a supply-chain attack after breaching its networks.
Passwordstate is an on-premises password management solution used by over 370,000 security and IT professionals at 29,000 companies worldwide, as the company claims.
Its customer list includes companies (many of them in the Fortune 500 rankings) from a wide range of industry verticals, including government, defense, finance, aerospace, retail, automotive, healthcare, legal, and media.
According to a notification email regarding the supply-chain attack sent to customers, malicious upgrades were potentially downloaded by customers between April 20 and April 22.
"Initial analysis indicates that bad actor using sophisticated techniques had compromised the In-Place Upgrade functionality," Click Studios told customers in an email with the "Confirmation of Malformed Files and Essential Course of Action" title.
"Any in-Place Upgrade performed between 20th April 8:33 PM UTC and 22nd April 0:30 AM UTC had the potential to download a malformed Passwordstate_ipgrade.zip [..] sourced from a download network not controlled by Click Studios," the company added.
"The attackers crudely added a 'Loader' code section, just an extra 4KB from an older version" to Passwordstate's original code, said J. A. Guerrero-Saade, SentinelOne Principal Threat Researcher.
"At a glance, the Loader has functionality to pull a next stage payload from the C2 above. There's also code to parse the 'PasswordState' vault's global settings (Proxy UserName/Password, etc)."
