Browser-in-the-Browser (BitB)

Browser-in-the-browser (BitB) is a phishing technique in which a web page draws a fake browser popup window, complete with title bar, address bar and padlock, out of HTML and CSS, so a spoofed sign-in form appears to come from a trusted domain such as accounts.google.com.

The researcher mr.d0x published the technique and templates in March 2022, mimicking the popups used for "Sign in with Google", Microsoft or Apple, and pointed out that the URL is usually the thing security-aware users trust most. In a BitB window the address bar is part of the attacker's page, so "check the URL" training gives the wrong answer. Current kits pair the fake window with live relay of credentials and MFA codes: the RecruitTrap campaign ran it across more than 3,000 recruitment phishing URLs, and in October 2026 Island described fake ChatGPT, Gemini and Claude ad portals whose "Connect" button opens a BitB window showing a Google or Okta address while an operator picks which MFA challenge to show next. The dependable defense is phishing-resistant MFA: a passkey or security key checks the real origin of the page, not what the window draws, and will not produce a credential for the phishing domain.

See also: adversary-in-the-middle, AitM phishing proxy, OTP relay social engineering, social login