Most guidance on spotting a phishing login page comes down to one habit: look at the address bar before typing a password. Browser-in-the-browser phishing, first documented publicly in 2022 and still showing up in credential-theft campaigns today, was built around the fact that most people never question whether the address bar itself is real. It usually starts with an ordinary-looking page, a marketplace listing, a game key giveaway, a shared document, that offers to sign in with Google or Microsoft. Clicking it doesn't open a new browser window. It opens what looks like one.
1. It's a picture of a popup, not a popup
Plenty of legitimate sites use a small popup window for single sign-on: click "Sign in with Google," a compact window opens with Google's real login page inside it, and it closes itself once the sign-in completes. A browser-in-the-browser attack recreates that entire window using HTML and CSS on the attacker's own page. The title bar, the padlock icon, the close button, and the address bar showing something like accounts.google.com are all part of the page underneath, styled to sit in a floating box that looks exactly like an operating-system window. The actual login form inside it is the attacker's, collecting whatever gets typed.
2. Why it beats the "check the URL" habit
Security awareness training spends a lot of time teaching people to glance at the address bar before entering a password, and for a real popup or a real tab, that check works because the browser itself controls that bar and the website can't rewrite it. A browser-in-the-browser popup breaks that assumption completely. Its "address bar" is ordinary page content, so it displays whatever text the attacker chooses. There's no mismatch to spot, because nothing about it was ever connected to where the page is actually loading from in the first place.
3. What still gives it away
A fake window can copy how a real one looks, but not how a real one behaves. Try to drag the popup past the edge of the browser tab it appeared in, or move the whole browser window around the screen; a genuine popup is a separate, operating-system-level window and travels independently, while a fake one is trapped inside the page and either refuses to move past the boundary or drags the whole underlying page along with it. A password manager that autofills based on the site's real address is another reliable check, since it has no reason to offer credentials to a popup that isn't actually hosted on that address. When in doubt, closing the tab entirely and navigating to the real service directly, rather than trusting the "sign in" button that opened it, avoids the question altogether.
This sits in the same family as the sign-in tricks covered in OAuth consent phishing against Microsoft 365 and device code phishing, both of which also work by staying close to a real sign-in flow instead of imitating one badly. What makes browser-in-the-browser worth knowing on its own is that it targets the one thing most training treats as unquestionable: the browser's own address bar. Once that's not a safe assumption, testing whether the window is real takes its place.
Frequently asked questions
What is a browser-in-the-browser (BitB) phishing attack?
It's a fake login popup built entirely out of the webpage the target is already on, using HTML and CSS to draw a window that looks like the small sign-in popup real sites open for buttons like Sign in with Google or Sign in with Microsoft. The title bar, the close button, and the address bar showing what looks like the real login domain are all just images and text on the page, not an actual separate browser window.
If the address bar shows the real login URL, how is it fake?
Because that address bar isn't a real one. In an actual OAuth popup, the address bar is drawn by the browser itself and can't be edited by the website underneath it. In a browser-in-the-browser attack, the entire popup, address bar included, is content the attacker's page controls, so it can display any URL text at all, real or fake, since nothing is actually verifying it against where the page is loading from.
How do you spot a browser-in-the-browser popup if the URL looks right?
Try to drag the popup outside the boundaries of the browser window it appeared in, or drag the whole browser window itself. A real popup is a separate window and moves independently; a fake one is trapped inside the page and either won't move past the browser's edge or drags the entire page with it. A password manager that autofills by matching the real site address is also a reliable check, since it won't offer to fill credentials into a popup that isn't actually on that address.
Not sure your team would question a login popup that looks completely real?
30 minutes with an engineer with DoD infrastructure experience. We'll walk through what your team would actually do when a sign-in window shows up, and where phishing-resistant MFA closes the gap this kind of attack is built to slip through.
Book your free assessmentPrefer to talk first? Email sales@ghosxt.com or call (831) 204-0501.