Skip to content
attack.paths
Iniciar sesión
← RegistryDossier · 6 steps · 5 edges

Browser-in-the-Browser → credential theft on a trusted page

Render a fake SSO popup inside the attacker page that looks like a real OS browser window. Victim types their credentials into the attacker's DOM.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target uses SSO that opens a popup window. Phishing landing page hosted on attacker domain (often a typosquat or compromised legitimate site).

§ Steps

  1. 01
    Victim enters creds in fake popupInitial Access
    T1078— Valid Accounts
  2. 02
    Lure victim to attacker pageInitial Access
    T1566— Phishing
  3. 03
    Victim clicks SSO buttonExecution
    T1204— User Execution
  4. 04
    Hijack post-MFA session if applicableCredential Access
    T1539— Steal Web Session Cookie
  5. 05
    Use creds against the real IdPInitial Access
    PH-AITM-EVILGINX— AITM Phishing — Evilginx / Modlishka
  6. 06
    Build BitB popup overlayInitial Access
    PH-BITB— Browser-in-the-Browser (BitB)

§ References

§ Frequently asked

What is the "Browser-in-the-Browser → credential theft on a trusted page" attack path?
Render a fake SSO popup inside the attacker page that looks like a real OS browser window. Victim types their credentials into the attacker's DOM. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Victim enters creds in fake popup (T1078) — a initial access primitive. Assumed environment: target uses SSO that opens a popup window.
What is the final impact of this kill-chain?
The final step lands on Build BitB popup overlay (PH-BITB), which falls under Initial Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers