How does browser-in-the-browser phishing work?
Short answer
The page draws a fake sign-in pop-up, address bar and all, using ordinary HTML. Because that "window" is part of the page, you cannot drag it outside the browser tab, which is a quick tell.
Mechanism
Many sites let you "Sign in with Google" or "Sign in with Microsoft" in a pop-up window. A browser-in-the-browser page imitates that pop-up inside the page itself: a drawn title bar, a drawn padlock, and a drawn address bar showing the real provider's domain. What you type goes to the attacker.
How to spot it
- Try to drag the pop-up outside the browser window. A real window moves; a drawn one stops at the edge of the tab.
- Click into the address bar of the pop-up. On a fake one you usually can't select or edit the text.
- If a password manager doesn't offer to fill your saved login, ask why before typing it yourself.
Who it targets
Anyone who signs in with a work or social account, and especially business users, because one work login can open email, files and other connected apps.
Defenses
- Phishing-resistant sign-in, such as passkeys or security keys, which are bound to the real domain.
- A password manager that only fills credentials on the real site.
Haven's role
Pending technical review. We haven't yet documented whether Haven flags browser-in-the-browser pages specifically, so this section stays empty until engineering confirms it.