Loading story…
A publicly released Browser-in-the-Browser (BitB) phishing toolkit is making it easier to build fake Chrome-style pop-up windows that imitate legitimate single sign-on prompts from providers such as Google, Microsoft, and Apple. The templates, published by security researcher mr.d0x on GitHub and detailed on his site, allow attackers or red teams to customize browser window titles and displayed URLs so the phishing prompt appears to be a real browser-based authentication dialog.
The technique is designed to increase the credibility of credential-harvesting pages by mimicking familiar login flows inside a forged browser window, lowering the barrier to entry for less sophisticated operators. Reporting noted that BitB-style attacks had already been observed in earlier campaigns, including lures targeting Steam users, and warned that the approach can be paired with phishing frameworks such as Evilginx to capture credentials and potentially steal 2FA session data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Security researcher mr.d0x released Browser in the Browser phishing templates that simulate Chrome single sign-on popup windows for services such as Google, Microsoft, Apple, Twitter, and Steam. The templates allow customization of the displayed URL and window title and were presented as usable for red-team testing or phishing abuse.
Zscaler reported that fake gaming sites used the Browser in the Browser technique in attacks targeting Steam credentials. The article cites this as evidence that the technique was already in use before the later template release.
Kuba Gretzky, creator of the Evilginx phishing toolkit, tested the Browser in the Browser method with Evilginx and showed that it worked. This demonstrated that the fake browser-window technique could be combined with a phishing framework capable of capturing credentials and potentially 2FA session data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported a **Browser-in-the-Browser** phishing campaign targeting Microsoft 365 users with fake OAuth sign-in popups embedded inside malicious webpages. The attackers render the window with HTML, CSS, and JavaScript to mimic a legitimate browser authentication prompt, complete with a spoofed Microsoft URL, padlock icon, draggable behavior, and visual tailoring for Windows, macOS, Linux, Chrome, Firefox, Edge, and Safari. The credential-harvesting flow is delivered through a sandboxed iframe, separating the visible lure from the collection mechanism and making investigation more difficult. Researchers said the campaign uses multiple evasion techniques, including blocking debugging functions, fragmenting keywords and visible strings to bypass filters, and redirecting bots or scanners to a legitimate Microsoft Office help page. Victims who submit credentials can have their Microsoft 365 logins stolen, and attackers may also capture OAuth consent grants or session-like tokens that can preserve access to Microsoft 365 and connected cloud services even after a password reset. Unit 42 published domains linked to the activity and urged defenders to monitor for suspicious active sessions, revoke suspicious tokens, enforce conditional access for managed devices, and adopt phishing-resistant authentication such as **passkeys** or **FIDO2 hardware keys**.
Jun 29, 2026
Threat actors are leveraging a Phishing-as-a-Service (PhaaS) kit called **Sneaky 2FA** to deploy advanced Browser-in-the-Browser (BitB) phishing attacks. This kit allows attackers to create highly convincing fake browser pop-up windows that closely mimic legitimate sign-in prompts, including a forged address bar displaying authentic-looking URLs. The technique is designed to deceive users into entering their credentials, which are then exfiltrated to the attacker. Security researchers have observed these attacks targeting Microsoft account credentials, with the kit's obfuscated code and anti-analysis features making detection and mitigation more challenging. The Sneaky 2FA kit is available on criminal marketplaces, enabling even less-skilled threat actors to launch sophisticated phishing campaigns at scale. Attackers often use additional evasion tactics, such as bot protection checks (e.g., Cloudflare Turnstile) and CAPTCHAs, to filter out automated security tools before presenting the fake login window to real users. Experts recommend using password managers, which can help detect these fake forms by refusing to autofill credentials on non-legitimate login pages, as a key defense against such deceptive phishing techniques.
Jun 29, 2026
Threat actors have increasingly used the **browser-in-the-browser (BitB)** technique to steal **Facebook** credentials, leveraging fake in-browser pop-up login windows that closely mimic legitimate authentication flows. Trellix reported that recent campaigns commonly start with phishing emails impersonating law firms issuing copyright infringement warnings, threats of imminent account suspension, or *Meta* security alerts about suspicious logins; these lures often include shortened links and fake Meta CAPTCHA pages to add legitimacy before presenting the counterfeit login prompt.
Jun 29, 2026