Anyone can now generate bogus Chrome browser windows thanks to a new phishing toolkit

Red teamers and cybercriminals may now develop successful single sign-on phishing login forms using phony Chrome browser windows thanks to the introduction of a phishing kit. It’s typical to see options to sign in with Google, Microsoft, Apple, Twitter, or even Steam when visiting websites. For instance, the DropBox login screen, as shown below, makes it possible to connect with an Apple or Google account.

A single-sign-on (SSO) browser window will appear when you click the Login in Google or App buttons, enabling you to input your credentials and log in with the account. These Windows have been trimmed down to just the login form and an address bar with the login form’s URL.

Cyber attackers have managed to generate false SSO windows in the past using HTML, CSS, and JavaScript, but the windows always have something odd about them, making them suspicious. This is where a new “Browser in the Browser (BitB) Attack” comes into play, in which prefabricated templates are utilized to build phony yet realistic Chrome popup windows with customized address URLs and headlines that can be used in phishing attacks.

To produce convincing phishing scams, this method generates false browser windows within genuine browser windows (Browser in the Browser). Mr.d0x, a…