Browser-in-the-Middle Attack

A browser-in-the-middle (BitM) attack tricks victims into logging in through an attacker-controlled remote browser, giving the attacker a fully authenticated session despite MFA. In a campaign tracked since April 2025, attackers rendered pixel-perfect fake browser windows that imitated Facebook logins and displayed a legitimate-looking URL.