BitB Phishing: How Fake Login Windows Work and How to Stop Them

Fake Google login windows capture passwords and 2FA 😳 (YouTube link)

Understanding BitB Scams

In a normal login flow, a genuine authentication pop‑up—such as one from Google or Microsoft—is a separate operating‑system window. Because it exists outside your browser, you can drag it anywhere on your desktop, move it across monitors, or let it overlap other applications. Its behavior is a key indicator of authenticity.

A Browser‑in‑the‑Browser (BitB) scam imitates this experience, but only visually. Instead of generating a real system window, attackers craft a perfectly styled fake login box entirely inside a webpage using HTML and CSS. 

How Fake Login Windows Mimic Real Pop‑Ups  

“Grab and Move” Test

A reliable way to spot a Browser‑in‑the‑Browser (BitB) phishing attempt is the “grab and move” test. A genuine OAuth login window—like one from Google or Microsoft—is a true operating‑system window, completely independent of the webpage beneath it. Because it exists outside the browser, you can drag it anywhere on your screen, slide it across monitors, or let it overlap other apps. This free movement is a hallmark of an authentic pop‑up.

BitB attacks recreate this experience as a visual illusion. Instead of generating a real window, attackers build a fake login box using HTML, CSS, and JavaScript, often embedding the credential form inside an iframe. Since this imitation is actually part of the webpage’s layout, it is trapped inside the browser tab. Try to drag it beyond the browser’s borders—past the address bar or outside the frame—and it will abruptly stop or clip off, revealing that it isn’t a real pop‑up at all.

This deceptive design aims to lure users into entering credentials into a page‑embedded fake window that looks indistinguishable from a trusted login provider. You can explore more about BitB attacks or how to spot fake login windows.

Additional Ways to Verify a Legitimate Login Window

When you can’t rely on dragging a pop‑up—such as on mobile devices—or you simply want extra confirmation, these checks help distinguish a real OS‑level login window from a Browser‑in‑the‑Browser illusion:

• Maximize/Minimize Behavior — Real authentication windows respond normally to minimize/maximize buttons. Fake BitB pop‑ups often ignore these controls or behave in ways that don’t match your operating system.
• Scrollbar & Zoom Test — Zoom out or scroll the main webpage. A fake BitB window will shrink or move with the page layout because it’s just HTML inside the site. A genuine pop‑up stays fixed and independent.
• Keyboard Shortcut Check — Press Ctrl + L (Windows) or Cmd + L (Mac) while focused on the pop‑up. A real window highlights its own URL bar. A BitB fake highlights the parent site’s URL bar instead, revealing that the “window” is actually part of the webpage.

Effective Mitigations Against BitB Attacks

Strengthening your protection against Browser‑in‑the‑Browser scams starts with adopting safer login habits and verifying every authentication prompt carefully. These practical steps help reduce the risk of entering credentials into a fake, page‑embedded pop‑up.

• Avoid OAuth logins on untrusted sites — especially Sign in with Google or similar one‑click login buttons that attackers frequently imitate.
• Use a password manager with domain‑restricted autofill — tools that only fill credentials on verified URLs make it harder for BitB pages to steal your login.
• Prefer hardware security keys — physical authentication devices add a strong layer of protection that phishing pages cannot bypass.
• The Scrollbar Check — If you zoom out on your browser or scroll down the main webpage, a fake BitB window will often scroll or shrink right along with the page layout. A real pop-up remains completely fixed.
• Check the browser’s URL bar and site origin — confirm the domain before entering any credentials, especially if a login window appears unexpectedly.
• In BitB attacks, the fake popup includes a fully styled internal "address bar" displaying spoofed legitimate domains (e.g., accounts.google.com with padlock), but the real browser URL bar at the top of the window always shows the attacker's malicious domain.
• Unexpected login pop-ups (especially after clicking "Sign in with Google" on a third-party site) warrant immediately checking the main browser's address bar and hovering over any links/icons for the true origin; legitimate OAuth flows open in separate windows with their own isolated URL bar.
• This check, combined with the drag test, defeats most visual spoofs since the embedded fake cannot alter the parent page's actual origin or security indicators.