Browser-in-the-Browser Attack

A browser-in-the-browser (BitB) attack simulates the small popup window that appears during single sign-on — "Sign in with Google," "Sign in with Microsoft," "Sign in with Apple" — entirely inside the attacker's web page. Using HTML, CSS, and JavaScript, the attacker draws a fake browser window, complete with a title bar, padlock icon, and a spoofed address bar showing the legitimate URL (accounts.google.com, login.microsoftonline.com). The victim believes they are typing their password into a trusted OAuth popup; in reality every keystroke lands in a form controlled by the attacker.

How it works

The victim first arrives on an attacker-controlled page — via a phishing email, a malicious ad, or a compromised site. When they click a familiar SSO button, the page renders the counterfeit popup. Because the entire "window" is just an image built from page elements, the attacker fully controls what the address bar displays, defeating the "check the URL" habit that traditional phishing training instills. The technique was documented in detail by the researcher mr.d0x in 2022 and has since appeared in real campaigns, including operations attributed to state-aligned groups and credential theft targeting gaming and enterprise SSO accounts.

BitB is often combined with adversary-in-the-middle tooling so that captured credentials and session tokens are replayed against the real identity provider instantly — bypassing simple MFA in the process.

How to defend against it

• Try to drag the popup out of the browser window. A real OS-level window can move beyond the browser's edge; a fake one is clipped inside the page. This one-second test reliably exposes BitB.
• Rely on a password manager. Autofill matches the true domain of the page, not the pixels drawn on it — a password manager will refuse to fill credentials into a fake popup.
• Deploy phishing-resistant MFA. FIDO2 security keys and passkeys bind authentication to the real origin, so credentials phished through a fake window cannot be replayed.
• Simulate it. Include BitB scenarios in phishing simulations so employees encounter the fake-popup pattern before an attacker shows it to them.