Top 2026 2FA & AiTM Detection: Browser-in-the-Browser (BitB) Fake Login Popup In

Ibrahim Saud@tektrix

•updated 11 days ago•0•0•1

Detects Browser-in-the-Browser (BitB) phishing pages by inspecting web proxy or EDR-captured page content for malicious HTML/JS structures. The rule identifies fabricated browser chrome, such as fake address bars and title bars, initialized via window.open with specific dimensions, while ensuring the serving domain is not a known, legitimate identity provider.