What is browser-in-the-browser phishing, and how do you spot a fake pop-up?

Most people know to check the address bar before typing a password. Browser-in-the-browser (BitB) phishing is built to beat that habit: it draws a fake sign-in window, address bar included, inside a web page you were sent to. This guide explains how the trick works, the quick physical tests that expose it, and the settings that stop a stolen password from mattering.

What is browser-in-the-browser (BitB) phishing?

Browser-in-the-browser phishing is a technique that fakes a single sign-on (SSO) pop-up window inside an ordinary web page. Single sign-on is the "Sign in with Google", "Sign in with Microsoft" or "Sign in with Apple" button many sites offer, which normally opens a small separate window from the identity provider. In a BitB attack, that window is a drawing. Its title bar, padlock and address bar are made with HTML and CSS, and the "address" shows whatever the attacker types, such as https://accounts.google.com.

The technique was published by a security researcher, mr.d0x, on March 15, 2022. The write-up describes "a phishing technique that simulates a browser window within the browser to spoof a legitimate domain," and says that combining the fake window with an embedded frame makes the result "basically indistinguishable" from the real thing. Ready-made templates for Chrome on Windows and macOS, in light and dark mode, were published alongside it.

Attackers picked it up quickly. Two weeks later, Google's Threat Analysis Group (TAG) reported that the Belarusian group Ghostwriter had "quickly adopted this new technique," layering a fake login dialog over pages on compromised websites, and noted that TAG had "previously observed this technique being used by multiple government-backed actors." In April 2023, TAG described a North Korea-linked group sending links to BitB pages that "present users with a fake browser window rendered inside the actual browser window" (Google TAG).

How does a browser-in-the-browser attack work?

A BitB attack always needs you to land on a page the attacker controls first. The original write-up notes that the target "would still need to land on your website" for the pop-up to appear. Email is the usual way to get you there:

1. The lure. An email asks you to view a shared document, sign a contract, check a voicemail or claim a refund. The link leads to a page that looks like a normal document viewer or business site.
2. The button. The page shows a "Sign in with Microsoft" or "Continue with Google" button, often with a short message such as "Verify your identity to view this file."
3. The fake pop-up. Clicking the button runs a script that shows a window-shaped box on top of the page. It has a title bar, minimize and close buttons, a padlock and a believable address.
4. The form. Inside the box is the attacker's sign-in form, loaded from their own server. You type your email address and password, and often an MFA code.
5. The capture. What you type goes to the attacker. The page may then send you on to a real document or the real service so nothing seems wrong.

Here's a simplified example of what the fake address bar can be. It is not part of your browser; it's an ordinary element on the attacker's page:

<!-- Example only: a "pop-up" address bar is just text on the attacker's page -->
<div class="fake-window">
  <div class="fake-titlebar">Sign in - Google Accounts</div>
  <div class="fake-addressbar">[padlock] https://accounts.google.com/signin/v2</div>
  <iframe src="https://attacker.example/collect"></iframe>
</div>

The padlock and address are characters inside a div. The real page you are on is still attacker.example, which is what your browser's own address bar at the very top of the screen shows.

A typical lure email looks like an everyday business message. The example below is invented for illustration:

Example of a lure (not a real message): From: "Accounts Payable" <ap@northwind-billing.example> Subject: Remittance advice INV-20931

Hi, please find the remittance for last month's invoice. The file is protected; sign in with your Microsoft or Google account to view it. [View remittance]

How is BitB different from a normal fake login page or AiTM phishing?

The three techniques overlap, and kits can combine them. What differs is where the deception sits.

The window can also contain an AiTM proxy instead of a static form, which lets the attacker relay your MFA code in real time. Our guide to adversary-in-the-middle phishing explains that part, and fake Microsoft login pages lists the domains Microsoft really uses for sign-in.

How do I tell a fake sign-in pop-up from a real one?

A real sign-in pop-up is a separate browser window managed by your operating system, while a BitB pop-up is part of the web page and can't leave it. That difference gives you several tests that take seconds:

1. Drag it. Grab the pop-up's title bar and drag it past the edge of the main browser window. A real pop-up moves anywhere on your screen. A fake one stops at the edge or gets clipped, because it's painted inside the page.
2. Look at your taskbar or window switcher. On Windows, press Alt+Tab; on a Mac, use Mission Control. A real pop-up is its own window. A fake one doesn't appear separately.
3. Maximize or minimize it. On a fake window, the buttons may do nothing, or do something odd such as closing the whole overlay.
4. Click in the address bar. In a real pop-up you can select and copy the address. In a fake one, the "address" is often just text or an image that doesn't behave like an input.
5. Watch your password manager. Password managers fill credentials for the real domain. If yours normally fills your work password but offers nothing in this window, close it.
6. Check the address of the page behind it. Close or ignore the pop-up and read the main address bar. If you were sent to a document viewer on an unfamiliar domain, that domain is where your password would go.

On phones, sign-in usually happens in a full-screen browser tab or an in-app sheet rather than a pop-up window, so the drag test doesn't apply. The safe habit there is the same as on a desktop: don't sign in from a link in an email at all. Open the app, or type the service's address yourself. Our guide on how to check if a link is safe covers reading the real domain in a link before you tap it.

Why do email filters miss browser-in-the-browser phishing?

Email filters miss BitB phishing mainly because the email itself rarely contains anything malicious. The message carries a link to a page that may look harmless when a scanner visits it. Several things work in the attacker's favor:

• The fake window appears only after a click. The pop-up is drawn by a script after the visitor presses a button. An automated scanner that loads the page but doesn't click may see a plain document viewer.
• Compromised and legitimate hosting. Google TAG saw Ghostwriter host its BitB pages on compromised websites. A long-established site has a better reputation than a domain registered yesterday. See phishing links on trusted cloud services for the same idea applied to cloud platforms.
• The real brand's domain is in the page as text. A scanner that looks for lookalike domains in links won't find one, because accounts.google.com appears only as words inside the fake window.
• Kits make it cheap. Templates for the window are freely available, and phishing kits sold as a service bundle features like this so the buyer needs no skill. See phishing-as-a-service kits.

Time-of-click link checking helps here, because the link is evaluated again when someone actually opens it. Microsoft says Safe Links in Defender for Office 365 provides "time-of-click verification of URLs and links in email messages, Teams, and supported Office 365 apps" (Microsoft Learn). Microsoft says clicked URLs are checked against a list of known malicious URLs, with unknown ones scanned in the background, so a brand-new page can still get through.

Does MFA stop browser-in-the-browser attacks?

It depends on the type of MFA. Codes and push approvals don't stop BitB, because you type the code into the fake window or approve a sign-in the attacker started. Phishing-resistant MFA does stop it.

NIST SP 800-63B, section 3.2.5, says authenticators "that involve the manual entry of an authenticator output (e.g., out-of-band and OTP authenticators) SHALL NOT be considered phishing-resistant." Phishing resistance comes from cryptographic authentication bound to the real site, which NIST calls verifier name binding.

That binding is what defeats BitB. When you use a passkey or FIDO2 security key, your browser checks the domain of the page that is really asking, which is the attacker's domain behind the fake window. The text in the fake address bar plays no part. The passkey for your Microsoft or Google account simply isn't offered there. CISA's phishing-resistant MFA fact sheet calls FIDO/WebAuthn "the only widely available phishing-resistant authentication." Our guide to passkeys for email explains how to roll them out.

What should admins set to reduce BitB risk?

Admins can't stop someone drawing a fake window, but they can cut the lures, warn at click time and make a stolen password useless. At the time of writing (November 2026), these are the relevant controls.

Microsoft 365

1. Require phishing-resistant MFA. In the Microsoft Entra admin center, create a Conditional Access policy that requires the built-in Phishing-resistant MFA authentication strength, starting with admins and anyone who approves payments. Conditional Access needs a Microsoft Entra ID P1 license. The steps are in our AiTM guide.
2. Check Safe Links coverage if you have Defender for Office 365. Microsoft notes there's no default Safe Links policy, but the Built-in protection preset applies Safe Links to recipients not covered by another policy. Microsoft recommends leaving Let users click through to the original URL off. Settings are in our Safe Links and Safe Attachments guide.
3. Purge after the fact. When a BitB campaign is reported, find and remove every copy; see remove a phishing email from all mailboxes.

Google Workspace

1. Turn on link protections. In the Admin console, go to Apps > Google Workspace > Gmail > Safety, and under Links and external images turn on Identify links behind shortened URLs and Show warning prompt for any click on links to untrusted domains (Google Workspace Admin Help). Our advanced phishing and malware protection guide covers each option.
2. Enforce security keys or passkeys for high-risk staff through 2-Step Verification enforcement; see Google Workspace 2-Step Verification enforcement.
3. Offer stronger browsing protection. For people likely to be targeted, Google recommends its Advanced Protection Program and Enhanced Safe Browsing in Chrome.

Training that works

Teach the drag test and the password-manager test, and one rule: a sign-in prompt reached from an email link is suspect by default. Show staff a harmless demonstration of a BitB window in a training session; seeing a fake address bar once makes the point better than any slide.

What should I do if I typed my password into a fake pop-up?

Act quickly, because the attacker may already be signing in.

1. Change the password from a device you trust, by typing the service's address yourself.
2. Tell your IT team so they can revoke your sessions and check for new MFA methods. If you also entered a code, assume the attacker has a session.
3. Check for inbox rules and forwarding you didn't create; see malicious inbox rules and auto-forwarding.
4. Warn your contacts if the account sent anything unusual after the incident.

Our step-by-step guide on what to do after clicking a phishing link covers the full checklist for personal and work accounts.

Next steps

• Try the drag test today on a real "Sign in with Google" or "Sign in with Microsoft" pop-up, so you know how a genuine window behaves.
• Move admins and finance staff to passkeys or FIDO2 security keys first.
• Turn on time-of-click link warnings in Microsoft 365 or Google Workspace.
• Reduce the lures that reach inboxes. iBlockSpam filters phishing and spoofing at the MX before mail reaches Microsoft 365 or Google Workspace, and the free Email Header Analyzer shows where a suspicious message really came from.

Browse our other phishing and threat guides.