Browser-in-the-Browser Phishing: How It Works and How to Detect It

The BitB technique was publicly documented by security researcher mr.d0x in 2022 and has since been incorporated into phishing toolkits. Implementation: an attacker creates a phishing page that mimics a legitimate website offering 'Sign in with Google/Microsoft/Apple.' When the user clicks the sign-in button, instead of opening a new browser window (which would have its own URL bar showing the real URL), the page renders a div element styled to look exactly like a browser popup window with a custom URL bar. The fake URL bar displays a convincing URL (accounts.google.com) as static text, not as an actual browser URL. The 'window' contains an iframe or a form that collects credentials. The attacker can drag and resize the fake window (using JavaScript) to make it behave like a real popup.

Traditional phishing detection advice focuses on checking the URL bar. BitB defeats this heuristic: the fake URL bar in the rendered window looks identical to a real browser chrome element. Users who check 'the URL bar' see what appears to be accounts.google.com. Standard indicators that a user has been trained to check (padlock icon, HTTPS, recognizable domain) are all present as static visual elements in the fake window. The actual page URL, visible in the real browser URL bar, would reveal the phishing domain, but users focused on the popup do not look at the underlying page URL. Usability research consistently shows that even security-trained users miss this.

Technical detections for BitB attacks operate at the browser and network layer:

The most complete defense against BitB credential theft is phishing-resistant authentication. FIDO2/WebAuthn (passkeys, hardware security keys) binds authentication to the specific origin of the page requesting credentials. When a user attempts to authenticate with a FIDO2 credential on a BitB phishing page, the authentication fails because the page's actual origin (phishing.example.com) does not match the origin the credential was registered for (accounts.google.com). The user never sees an error; the authentication simply does not complete. BitB attacks that steal a FIDO2-authenticated account's credentials are defeated by the protocol design: there are no credentials to steal in the traditional sense.

Standard phishing awareness training that focuses on URL inspection is insufficient for BitB. Effective BitB-specific training covers: the drag test (drag any SSO popup to the screen edge; if it cannot exit the browser, it is fake), the password manager indicator (if your password manager does not offer to autofill on an SSO popup, verify the popup's origin), and the keyboard shortcut test (in a real browser window, keyboard shortcuts work differently than in a page element). Include BitB simulations in your phishing simulation program: if your simulation tool does not support BitB templates, consider tooling that does. Measuring click and credential submission rates for BitB simulations separately from standard phishing simulations reveals whether your training is closing this specific gap.

BitB is now a standard module in multiple phishing frameworks. Evilginx (AiTM framework) added BitB support. Modlishka and several commercial phishing platforms have incorporated BitB templates. The primary targets are Microsoft 365, Google Workspace, and Steam SSO flows, because these are the most commonly used SSO providers with recognizable popup UI. Attackers typically deploy BitB in combination with domain spoofing (registering domains similar to the target organization) and send phishing links via email, SMS, or messaging platform to direct victims to the landing page.