A type of phishing attack, browser-in-the-browser (BitB), simulates a login window with a fake domain name inside a parent browser window to steal credentials.
If a user opts for single sign-on (SSO) to gain access to multiple interconnected websites or web applications, they may be exposed to malicious pop-ups designed to collect sensitive information from the user, such as login credentials. This type of phishing attack differs from a Browser attack in that it will display any URL that closely resembles a legitimate one. Cybercriminals can create a webpage inside a Browser which mimics a legitimate domain, thus exploiting users' preference for single sign-on who opt not to remember lengthy login credentials.
Cybercriminals can take advantage of users being unable to differentiate between a legitimate and a malicious domain once a pop-up window appears, thus increasing the risk of businesses offering single sign-on across their multiple applications getting exposed to browser attacks. For these businesses it is essential to be aware of the risks connected to SSO and implement rigorous security protocols to protect consumer information from harm.
Identifying fake login windows can be done in a few ways, even though it might not appear to be obvious. Login windows are browser windows, and they behave as such; they can be maximized, minimized, and repositioned on the screen. In contrast, fake pop-ups cannot be moved. Furthermore, they may obscure buttons and images in their borders, but only within their area.
To check if your login form is legitimate, you can try these steps:
It may seem at first that the attack is dangerous, but in reality it can be managed with an appropriate security solution. Even if a malicious site appears to be legitimate, the true address remains the same, and it's this that a security solution uses to detect anything suspicious.
Invest in a reliable password manager for all your accounts to ensure the authentic address of any website you visit. Additionally, make sure never to enter your credentials on a site you don't recognize, no matter how trustworthy it may seem. To further fortify your security, install a sturdy security solution that includes an anti-phishing feature. This will help verify the URL and alert you to any unsafe sites.
Don't forget to turn on two-factor authentication if it's available. This will stop intruders from being able to access your account, even if they get ahold of your credentials, because they won't be able to use the one-time code sent to you.
If you need extra security for high-risk accounts, U2F hardware tokens (YubiKey being the most popular) is what we suggest. This system verifies not just the address, but also the encryption key of a website, making it impossible for anyone to pass through the authentication process even if a website looks identical to the original.
Arrange a no-obligation consultation with one of our product experts today.