Hackers Leverage Browser-in-the-browser Tactic to Trick Facebook Users and Steal Logins
Facebook users are increasingly being targeted by a sophisticated phishing technique that circumvents traditional security measures. With over three billion active users, Facebook presents a lucrative target for attackers aiming to compromise accounts…
Facebook users are increasingly being targeted by a sophisticated phishing technique that circumvents traditional security measures. With over three billion active users, Facebook presents a lucrative target for attackers aiming to compromise accounts and gather personal credentials.
The primary goal of these attacks is to acquire login credentials to hijack accounts, spread fraudulent schemes, steal sensitive data, and commit identity fraud within victim networks.
In the second half of 2025, there was a noticeable increase in Facebook phishing campaigns, utilizing various methods to deceive users.
Browser-in-the-Browser (BitB) Technique
The Browser-in-the-Browser (BitB) technique is a notable innovation in these campaigns. This method involves creating a custom-built fake window that appears within the victim's legitimate browser window, making it difficult to differentiate from genuine authentication pop-ups. The technique exploits users' familiarity with login windows, leveraging their expectation to see such prompts when accessing the platform.
Facebook users are increasingly being targeted by a sophisticated phishing technique that circumvents traditional security measures.
The attack often starts with a phishing email disguised as communication from a law firm, containing a fake legal notice about an infringing video and a Facebook login link. The hyperlink uses shortened URLs that redirect to fake Meta CAPTCHA pages, adding additional layers of deception.
Upon interacting with these pages, users encounter what seems to be a legitimate Facebook login pop-up window. However, the underlying code reveals the attack's malicious nature. The Facebook URL is hardcoded within the fake interface, creating a fraudulent authentication environment.
This approach's sophistication lies in how attackers abuse legitimate infrastructure. Threat actors host phishing pages on trusted cloud platforms like Netlify and Vercel, leveraging their reputation to bypass security filters. URL shortening services further mask the actual destination, providing additional anonymity.
This combination of technical sophistication and social engineering represents a significant escalation in Facebook phishing tactics, requiring users to remain vigilant beyond standard security practices.
Based on reporting by Cyber Security News.