Browser-in-the-Browser Phishing Campaigns Targeting Facebook Credentials
Threat actors have increasingly used the browser-in-the-browser (BitB) technique to steal Facebook credentials, leveraging fake in-browser pop-up login windows that closely mimic legitimate authentication flows. Trellix reported that recent campaigns commonly start with phishing emails impersonating law firms issuing copyright infringement warnings, threats of imminent account suspension, or Meta security alerts about suspicious logins; these lures often include shortened links and fake Meta CAPTCHA pages to add legitimacy before presenting the counterfeit login prompt.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
2 events from the most recent confirmed update back to the earliest known activity.
Trellix discloses details of Facebook-focused BitB phishing campaigns
Trellix publicly reported that attackers were using iframe-rendered fake browser pop-up windows to mimic legitimate Facebook authentication flows and steal credentials. The company also described related tactics including URL shorteners, fake Meta Privacy Center pages, and appeal forms used to collect personal information.
Threat actors ramp up BitB phishing to steal Facebook credentials
Over roughly the six months preceding Trellix's January 2026 reporting, multiple threat actors increasingly used browser-in-the-browser phishing pages to capture Facebook logins. The campaigns used lures such as copyright infringement notices, account suspension warnings, and Meta security alerts, often hosted on platforms like Netlify and Vercel and paired with fake Meta CAPTCHA or appeal pages.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Browser-in-the-Browser Campaign Targets Microsoft 365 OAuth Logins
Palo Alto Networks Unit 42 reported a **Browser-in-the-Browser** phishing campaign targeting Microsoft 365 users with fake OAuth sign-in popups embedded inside malicious webpages. The attackers render the window with HTML, CSS, and JavaScript to mimic a legitimate browser authentication prompt, complete with a spoofed Microsoft URL, padlock icon, draggable behavior, and visual tailoring for Windows, macOS, Linux, Chrome, Firefox, Edge, and Safari. The credential-harvesting flow is delivered through a sandboxed iframe, separating the visible lure from the collection mechanism and making investigation more difficult. Researchers said the campaign uses multiple evasion techniques, including blocking debugging functions, fragmenting keywords and visible strings to bypass filters, and redirecting bots or scanners to a legitimate Microsoft Office help page. Victims who submit credentials can have their Microsoft 365 logins stolen, and attackers may also capture OAuth consent grants or session-like tokens that can preserve access to Microsoft 365 and connected cloud services even after a password reset. Unit 42 published domains linked to the activity and urged defenders to monitor for suspicious active sessions, revoke suspicious tokens, enforce conditional access for managed devices, and adopt phishing-resistant authentication such as **passkeys** or **FIDO2 hardware keys**.
Jun 29, 2026
Phishing Campaigns Exploiting Email Trust Mechanisms for Credential Theft
Attackers have launched multiple sophisticated phishing campaigns targeting business users by exploiting trusted email mechanisms and brand impersonation. One campaign abused the legitimate `@facebookmail.com` domain and Meta Business Suite’s invitation feature to send convincing phishing emails to Facebook Business users, primarily targeting companies in sectors like automotive, education, real estate, hospitality, and finance. These emails, which appeared authentic due to their origin from Meta’s infrastructure, redirected victims to credential harvesting sites, with some organizations receiving thousands of such messages. The attackers created fake business pages and mimicked official branding to increase the likelihood of success, as confirmed by security researchers who reproduced the attack method. Other campaigns have leveraged HTML attachments and spoofed internal notifications to bypass traditional email security. In Central and Eastern Europe, phishing emails with malicious HTML attachments embedded JavaScript to steal credentials, impersonating brands like Adobe and Microsoft and transmitting stolen data to attacker-controlled Telegram bots. Another campaign disguised phishing emails as spam filter alerts from within the victim’s own organization, using obfuscated code and personalized fake login screens to harvest credentials via websockets. These evolving tactics highlight the increasing sophistication of phishing operations and the need for organizations to monitor for unusual connections, inspect email content, and educate users about the risks of unsolicited attachments and internal-looking notifications.
Jun 29, 2026
Phishing-as-a-Service 'Sneaky 2FA' Kit Enables Browser-in-the-Browser Credential Theft
Threat actors are leveraging a Phishing-as-a-Service (PhaaS) kit called **Sneaky 2FA** to deploy advanced Browser-in-the-Browser (BitB) phishing attacks. This kit allows attackers to create highly convincing fake browser pop-up windows that closely mimic legitimate sign-in prompts, including a forged address bar displaying authentic-looking URLs. The technique is designed to deceive users into entering their credentials, which are then exfiltrated to the attacker. Security researchers have observed these attacks targeting Microsoft account credentials, with the kit's obfuscated code and anti-analysis features making detection and mitigation more challenging. The Sneaky 2FA kit is available on criminal marketplaces, enabling even less-skilled threat actors to launch sophisticated phishing campaigns at scale. Attackers often use additional evasion tactics, such as bot protection checks (e.g., Cloudflare Turnstile) and CAPTCHAs, to filter out automated security tools before presenting the fake login window to real users. Experts recommend using password managers, which can help detect these fake forms by refusing to autofill credentials on non-legitimate login pages, as a key defense against such deceptive phishing techniques.
Jun 29, 2026