Hackers are using browser-in-the-browser trick to steal Facebook logins

If you still use Facebook, I’m guessing you’re old enough to remember watching John Wayne movies in theaters. Nonetheless, it remains a pretty juicy target for hackers and digital thieves. They use a technique you should know about, even if your only interaction with the Facebook hellscape is through your loved ones: in-browser attacks.

A browser-in-browser attack (often abbreviated to BITB) is an old idea, but one that’s been given a new twist. You get a fake page that imitates a real page – nothing new, right? As long as you can see that you are at the correct URL in the browser (by carefully checking for lookalikes, such as “faceloook.com”), you are safe. A BITB attack creates both a fake page and fake browser elements around the page, including a legitimate-looking address in the URL bar. It’s simple, it’s sneaky, it’s effective.

Security vendor Trellix has released a new report indicating that these in-browser attacks are on the rise, specifically targeting Facebook users. The hook comes from the usual places, spam or texts that claim something is wrong with the account or there is some other security issue, but following the fake (but looks legitimate) URL takes you to a custom page with the BITB rendering trick. Adding a Captcha step can surprise users, and then a fake login page is enough to get a username and password.

Facebook is a very tempting target because of its massive number of users, more than two billion daily active by some measures. And a lot of them are, uh, a little less tech savvy. So not only are they more likely to follow a link in a phishing email and be tricked by an in-browser trick, but they’re probably also more likely to reuse their login passwords. This would make a successful phishing attack targeting impersonation material even more dangerous.

As Bleeping Computer notes, you can spot an in-browser attack by trying to interact with the fake internal browser. If you can’t click and drag the title bar, it’s an easy freebie. And as always, logging in through a separate window, browser, or device instead of following a link is a great way to quickly test the veracity of an alarming email.