Full Report
Hackers use the browser-in-the-browser technique to steal Steam accounts
Analysis Summary
# Tool/Technique: Browser-in-the-Browser (BitB) Phishing
## Overview
Browser-in-the-Browser (BitB) is an advanced phishing technique where a threat actor creates a simulated browser window within a legitimate-looking webpage. Unlike traditional phishing that relies on redirecting users to a malicious domain, BitB displays a fake pop-up window (often for OAuth or Third-Party SSO like Steam, Google, or Facebook) that appears to have a legitimate URL and a valid SSL padlock, making it nearly indistinguishable from a real login prompt.
## Technical Details
- **Type:** Phishing Technique / Social Engineering
- **Platform:** Web Browsers (Chrome, Firefox, Safari, Edge)
- **Capabilities:** Credential harvesting, 2FA bypass (via real-time interaction), session hijacking.
- **First Seen:** Early 2022 (Popularized by security researcher mr.d0x)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- **T1566 - Phishing**
- **T1566.002 - Phishing: Spearphishing Link**
- **TA0006 - Credential Access**
- **T1539 - Steal Web Session Cookie**
- **T1557 - Adversary-in-the-Middle**
## Functionality
### Core Capabilities
- **Visual Deception:** Uses HTML and CSS to render a perfect replica of a browser window, including an address bar, a fake SSL lock icon, and minimize/maximize/close buttons.
- **URL Spoofing:** Displays a legitimate-looking URL (e.g., `https://steamcommunity.com/login`) in the fake address bar, while the actual browser resides on a malicious domain.
- **iFrame Embedding:** Loads the malicious phishing kit within the simulated window to capture keystrokes in real-time.
### Advanced Features
- **Real-time Interaction:** Some kits allow attackers to relay 2FA codes immediately, enabling them to bypass Steam Guard or other MFA protections.
- **JavaScript Execution:** Relies on JS to handle the movement, closing, and data exfiltration of the fake window.
- **Localization:** Automatically adjusts the fake UI to match the victim's browser language settings.
## Indicators of Compromise
- **File Names:** Often associated with JavaScript templates like `popup.js` or `script.js` containing window-drawing logic.
- **Network Indicators:**
- `steamcommunity-login[.]xyz` (Defanged example)
- `steam-verification[.]org` (Defanged example)
- `s-team-community[.]com` (Defanged example)
- **Behavioral Indicators:**
- A pop-up window that cannot be dragged outside the bounds of the original parent browser window.
- A pop-up window that does not appear as a separate task in the OS taskbar.
## Associated Threat Actors
- **Cyber-mercenaries / Phishing-as-a-Service (PhaaS) groups:** Specifically those targeting Steam accounts for skin/inventory theft.
- **Lazarus Group:** Known to use similar "fake window" tactics in targeted campaigns.
## Detection Methods
- **Behavioral Detection:**
- Identifying windows that do not support standard OS features (e.g., resizing, snapping, or being dragged to a second monitor).
- Monitoring for attempts to click the "SSL Lock" that result in no action (as it is usually just a static image).
- **YARA Rules:** Can be written to detect common CSS/HTML strings used to render fake browser chrome (e.g., specific class names for fake address bars).
- **Browser Security:** Disabling JavaScript (though this breaks most modern sites).
## Mitigation Strategies
- **User Awareness:** Train users to attempt to drag login pop-ups. If the window disappears when moved past the edge of the original browser tab, it is fake.
- **Password Managers:** Legitimate password managers will *not* auto-fill credentials into a BitB window because the top-level domain is malicious, not the one shown in the fake address bar.
- **Hardware Security Keys:** Use U2F/FIDO2 keys (like YubiKeys) which are bound to the origin domain and resistant to phishing.
## Related Tools/Techniques
- **Adversary-in-the-Middle (AiTM):** Often used in conjunction with BitB to proxy traffic.
- **Typosquatting:** Often the "host" site for the BitB attack uses a domain name very similar to the target.
- **EvilProxy / GoPhish:** Frameworks that can be adapted to deliver BitB templates.