Browser-in-the-browser attack: a new phishing technique

[MuzzMelbourne]

Content source

https://www.kaspersky.com/blog/browser-in-the-browser-attack/44163/

We explain a new sneaky technique for stealing passwords, and how to avoid being tricked by a phishing site.

What is a browser-in-the-browser (BitB) attack?

What a “browser-in-the-browser” attack is, and how to prevent a phishing site that uses it from stealing your password.

www.kaspersky.com

 

[blackice]

What is a browser-in-the-browser (BitB) attack?

What a “browser-in-the-browser” attack is, and how to prevent a phishing site that uses it from stealing your password.

www.kaspersky.com

This actually seems pretty concerning. Most phishing is pretty obvious. This is much less so. Even fairly cautious people could be deceived. But since the fake Browser in the Browser is still at the phishing site password managers shouldn't feed the password automatically which is good.

 

[SeriousHoax]

This actually seems pretty concerning. Most phishing is pretty obvious. This is much less so. Even fairly cautious people could be deceived. But since the fake Browser in the Browser is still at the phishing site password managers shouldn't feed the password automatically which is good.

I wonder if features like HTTPS scanning provided by some products will make it easier to identify these.

 

[MuzzMelbourne]

This is why I don’t use password managers or auto-fill functions. Login details are only stored in my necktop computer…

 

[blackice]

This is why I don’t use password managers or auto-fill functions. Login details are only stored in my necktop computer…

I think the autofill function wouldn't work in this case, since the page is actually just the phishing url spoofing a page.

 

[MuzzMelbourne]

I think the autofill function wouldn't work in this case, since the page is actually just the phishing url spoofing a page.

Probably, but those sneaky little scammer types will work it out one day…