Attackers are increasingly abusing a technique called Browser-in-the-Browser (BitB) to steal Facebook login credentials from unsuspecting users.
- Instead of luring victims to fake sites, the scam creates a fake login pop-up window inside your real browser tab — mimicking a genuine Facebook login or OAuth authentication screen. It looks extremely real and can even show fake URLs and security icons.
- This makes it much harder for users to recognize it as phishing compared with traditional fake pages.
- Cybercriminals use cloud hosting like Netlify or Vercel to host these fake pages and make the trick scalable and hard to block.
How It’s Delivered
- Attack campaigns often start with phishing emails, deceptive links in messages, or bait such as fake legal/copyright notices that urge you to log in.
- Clicking the link opens a legitimate-looking login prompt inside the browser tab, but every credential you type goes straight to the attacker.
What Makes This Trick Dangerous
- The fake login looks visually identical to a real one because attackers copy UI, address bar, HTTPS padlock visuals, and even interactive elements.
- Users are trained by apps and websites to trust pop-up logins — and this exploit abuses that trust.
- BitB doesn’t need malware; it’s pure social engineering and visual deception.
How to Protect Yourself
Be cautious and verify before entering credentials:
- Check the real browser chrome:
A legitimate login pop-up from a service like Facebook should open in a separate browser window, not just an element inside a webpage.
2. Use a password manager:
Password managers auto-fill only on real sites. If it won’t auto-fill, that’s a red flag.
3. Enable two-factor authentication (2FA):
Even if credentials are stolen, 2FA can stop the attacker from logging in.
4. Avoid clicking login links in emails/messages:
Instead, navigate to Facebook manually via your browser’s address bar.
