Security News > 2022 > April > “Browser in the Browser” attacks: A devastating new phishing technique arises
Browser in the browser attacks consist of simulating a browser window within the browser to spoof a legitimate domain.
The principle is pretty straightforward: The user connects to a website, which in turn opens a new browser window that asks for Google, Apple, Microsoft or other third parties' credentials, to allow the user to log in.
Google's Threat Analysis Group reported a new attack campaign from known threat actor Ghostwriter.
The threat actor originates from Belarus and has deployed BITB attacks with the phishing pages being hosted by a compromised website.
We suspect a lot more threat actors will quickly adapt and use this new technique in their attack campaigns.
The best ways to avoid BITB attacks are actually the same as for usual phishing.
News URL
https://www.techrepublic.com/article/browser-in-the-browser-attacks-arise/
Related news
- Microsoft: Hackers steal emails in device code phishing attacks (source)
- Darktrace: 96% of Phishing Attacks in 2024 Exploited Trusted Domains Including SharePoint & Zoom Docs (source)
- Phishing attack hides JavaScript using invisible Unicode trick (source)
- FatalRAT Phishing Attacks Target APAC Industries Using Chinese Cloud Services (source)
- Hackers Exploit AWS Misconfigurations to Launch Phishing Attacks via SES and WorkMail (source)
- YouTube warns of AI-generated video of its CEO used in phishing attacks (source)
- Researchers Expose New Polymorphic Attack That Clones Browser Extensions to Steal Credentials (source)
- Ukrainian military targeted in new Signal spear-phishing attacks (source)
- Browser-in-the-Browser attacks target CS2 players' Steam accounts (source)
- Phishing platform 'Lucid' behind wave of iOS, Android SMS attacks (source)