USAA.com : a very different Login window "Your login information will be sent securely." popped up.

Options
jbthomson2
jbthomson2
Community Member
in Mac

This ersatz Login window appeared this morning one time. It did nothing and I fear credential harvesting:

1PW wouldn't fill it, it didn't work, I closed Safari window and opened a new one. It did not appear again.
I took steps to change my password and add additional security.
I'm thinking this is something running locally on my MacBook Pro. Safari 12.0.3, macOS 10.13.6 High Sierra.

Do you recognize it?

1Password Version: 7.1.2
Extension Version: 4.7.3
OS Version: OSX 10.13.6
Sync Type: Dropbox
Referrer: forum-search:"Your login information will be sent securely."

Comments

  • Ben
    Ben
    Options

    Hi @jbthomson2

    I'm not sure I'd jump to malware as the first conclusion here. While that is a possibility unless you've installed software from an untrustworthy source recently it seems unlikely. To help rule that out... Malwarebytes offers a reputable malware scanner for Mac with a 14-day free trial:

    Malwarebytes for Mac — Mac Antivirus Replacement | Malwarebytes

    We're not affiliated with Malwarebytes, and this is not an official endorsement, but that may help. I'd suggest giving that a go and reporting back. The prompt that you're seeing there is called an "HTTP Basic Authentication" prompt. They're not super common anymore, as most sites / services have moved to using a web form for filling in credentials. They are still somewhat prevalent with devices like consumer grade routers and other networking devices. I'm going to do some research and see if there are any other reports of such a prompt from USAA. You may wish to do the same.

    Some other questions that may be helpful:

    • Do you use any sort of a VPN or proxy server?
    • Do you have any extensions other than 1Password installed in your web browser (if so, which)? From your screenshot it looks like you may have a bunch. You may want to consider limiting those.
    • Did you install any software recently? If so which software, and from where?
    • Have you noticed this happening with any other websites?

    Ben

  • rogerl
    rogerl
    Community Member
    Options

    I had a similar (but the window was slightly different) issue. I called USAA and they basically said "beats us". I'm not sure if they took me seriously or just blew it off. I'm pretty tired of the crappy website support from this bank.

  • Lars
    Lars
    1Password Alumni
    Options

    @rogerl - this isn't the first time we've had people ask about USAA in particular, or report issues with it. I'm always hesitant to suggest that something like what you see in @jbthomson2's screenshot isn't some sort of malware (because someday, it will be, if adversaries try to create a lookalike phishing page)...but it is consistent with what we've seen. Sorry for the less-than-great experience, and let us know if you get any better information from USAA. In the meantime, you may wish to use their direct login page: https://www.usaa.com/inet/ent_logon/Logon -- some users have reported success with it.

This discussion has been closed.