Cybercriminals are getting smarter and sneakier all the time. It seems that as soon as the general public is prepared against a certain type of cyberattack, these criminals find a new strategy for stealing private information. Their latest such innovation is known as browser-in-the-browser (BiTB) attacks. As with every kind of phishing technique, it is critical for users to understand how they work and how to avoid falling prey to them.

Keep reading to learn about browser-in-the-browser phishing attacks and how to protect yourself and your company from them.

Cybercrime isn’t going anywhere. Check out seven cybersecurity statistics every small business needs to know.

X-in-the-Y Attacks

BiTB attacks are a type of X-in-the-Y attack, which puts them in the same phishing category as MiTM and MiTB attacks. Understanding these types of attacks can provide better insight into BiTB attacks.

Manipulator-in-the-Middle (MiTM) Attacks

In this kind of attack, cyber criminals aim to attack users in the middle of a network, not at the computer end or the server end. One of the most common entry points in these attacks are Wi-Fi routers. Hackers will take advantage of an open network, access that network, and then find weak passwords and steal private information. (Tip: HTTPS encryption protects against these kinds of attacks. Make sure your website has this encryption!)

Manipulator-in-the-Browser (MiTB) Attacks

In this kind of attack, cyber criminals install a Trojan horse on a computer. The Trojan horse can then modify the information that is sent from the browser to the server. This tactic is often used to manipulate and steal financial information. Unfortunately, HTTPS encryption doesn’t offer much protection for these types of attacks because it relies on malware.

Browser-in-the-Browser Attacks

So what happens in a browser-in-the-browser attack? In this kind of attack, cyber criminals create fake browser windows to lure in unsuspecting victims. Oftentimes, the fake browser windows are disguised as pop-up login pages. But here’s the interesting part: the fake browsers are simply images designed to look like your browser. If you tried to actually click on any of the browser buttons, such as the backspace or refresh icons, they wouldn’t work. This tactic is so rudimentary that it would be laughable…if it didn’t work!

Unfortunately, cyber criminals are smart. They know that many unsuspecting users will fall for fake browsers, as long as those browsers look identical to what they expect to see.

How to Guard Against BiTB Attacks

With BiTB attacks on the rise, it is important to know how to protect yourself and your employees from them. One of the best pieces of advice we can give in regards to these attacks is to be vigilant. If ever a pop-up window appears, no matter if you expect to see one or how secure it seems, stop before proceeding. Remember, BiTB attacks use images to trick you. You can’t trust a  URL with HTTPS or a security lock in these situations, because the fake images can include both of those things. Try clicking on some of the browser buttons. Try clicking in the URL bar. If you can’t do either of those things, contact your IT administrator immediately and tell them that you suspect a browser-in-the-browser attack.

Do not trust pop-up windows without testing them. It is always better to be safe than hacked!

Recent BiTB Attack on Steam Users

Just recently, cyber hackers have been using this sneaky technique to steal credentials from Steam users. Hackers create fake browsers that look like trustworthy invitations to tournaments. When users use the fake browser to log in, hackers receive their Steam credentials. Once they obtain the account credentials, hackers attempt to sell the credentials. According to Bleeping Computer, some of the gaming accounts are valued from $100,000 to $300,000.

Stay One Step Ahead of Cyber Criminals

Cardinal Technology Solutions provides comprehensive network security solutions to businesses in Winchester, Virginia and the surrounding areas. We ensure that you have the proper safeguards in place at all levels, including file and folder security, encryption, multi-factor authentication, real time antivirus, web filters, and anti-malware scanning and detection. Take the next step in protecting your business from cyber criminals and phishing attacks; request a quote today.

Related Blog Posts