Browser-Level Phishing Attack-Flow Evasion: Layered Redirects, Injected Scripts, Iframe AiTM and Credential-Harvesting DOM Manipulation
Browser-Level Phishing Attack-Flow Evasion (TL-2026-0924), also tracked as In-Browser Data Inspection, is a medium-severity phishing campaign, first published 2026-06-24. It has no confirmed attribution, affects Microsoft Microsoft 365 / Entra ID (Azure AD) identity sign-in, maps to 17 MITRE ATT&CK techniques (T1027, T1056, T1090), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-0924
- Threat ID
- TL-2026-0924
- Also known as
- In-Browser Data Inspection, Browser-Level Phishing Evasion, AiTM Phishing Attack Flow
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-06-24
- Last reviewed
- 2026-06-24
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- financial, government, healthcare, technology, professional services, education
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in Browser-Level Phishing Attack-Flow Evasion
Malware and tooling: Greatness, Mamba 2FA, NakedPages, Tycoon 2FA, ANY.RUN Interactive Sandbox — In-Browser Data Inspection, EvilProxy, Evilginx, Reverse-proxy AiTM phishing relay positioned between victim and legitimate identity provider
Modern URL phishing increasingly hides its kill chain behind dynamic, browser-only behavior — layered redirect chains, client-side injected scripts, iframe activations and credential-harvesting forms that static URL/file analysis never observes. ANY.RUN's in-browser data inspection executes suspect URLs in a real browser to capture the full execution tree (redirects, runtime DOM changes, network requests, injected code), exposing the adversary-in-the-middle (AiTM) and dynamic-evasion techniques that defeat conventional tooling and bypass MFA.
How Browser-Level Phishing Attack-Flow Evasion works
This entry documents the phishing-evasion attack-flow class that browser-level (in-browser) data inspection is purpose-built to detect, and the defensive analysis capability ANY.RUN released in June 2026 to close that visibility gap.
Static URL and file analysis inspects only the initial response: the landing HTML, headers, and any directly linked files. Modern phishing operations defeat this by deferring all malicious behavior to runtime, inside the victim's browser. A single phishing URL typically resolves through a layered redirect chain (URL shorteners, open redirects on trusted domains, CAPTCHA/Cloudflare-Turnstile gates, and conditional geo/UA filtering) before reaching the final credential-harvesting page. The final page renders benign static HTML, then mutates: client-side JavaScript injected after page load rewrites the DOM, activates hidden iframes, and assembles the fake login form dynamically. Because the malicious form, branding, and exfiltration logic only exist in the post-load DOM, network-only or file-only sandboxes capture nothing actionable.
The most damaging variant is adversary-in-the-middle (AiTM) phishing (MITRE ATT&CK T1557). Instead of a static credential-collecting page, the phishing site is a reverse proxy (Evilginx-class) sitting transparently between the victim and the genuine identity provider. The victim authenticates against the real login flow — including completing MFA — while the proxy relays every request and captures the resulting authenticated session cookie (T1539, Steal Web Session Cookie) and credentials (T1056.003, Web Portal Capture). Replaying the stolen session cookie (T1606.001, Forge Web Credentials) grants the attacker an authenticated session and fully bypasses MFA (T1111). Commercial Phishing-as-a-Service (PhaaS) kits — Tycoon 2FA, EvilProxy, Mamba 2FA, Greatness, NakedPages — and the open-source Evilginx framework have commoditized this technique, rewriting every reference to the legitimate domain across HTML, JavaScript, CSS, headers and cookies so the proxy is invisible to the victim.
ANY.RUN's in-browser data inspection executes the suspected URL in a full interactive browser and records everything that matters in one view: the complete execution tree from initial URL to final rendered page (highlighting every redirect hop and iframe activation), the runtime HTTP requests, and a dedicated HTML DOM Changes tab that diffs and deobfuscates code fragments added to the DOM after load (green lines mark newly injected code). Indicators — domains, IP addresses and file hashes — are collected automatically, and analysts can draft YARA rules against specific phishing DOM artifacts and run them across ANY.RUN's threat-intelligence corpus to pivot to related samples; the source reports a single YARA rule surfacing 14 related phishing samples. The vendor reports per-URL triage time falling from up to one hour of manual work to seconds, producing SOC-ready evidence packages (redirect chains, screenshots, DOM artifacts) for escalation.
This is defensive analysis tooling and a generic technique profile, not a discrete tracked campaign: there is no single CVE, named actor, or campaign-specific IOC set. The value is in encoding the attack-flow TTPs and the behavioral/DOM indicators so SOC analysts, threat hunters and detection engineers can build runtime-aware detection for browser-only phishing evasion.
MITRE ATT&CK techniques used in TL-2026-0924
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information
Credential Access
T1056 Input Capture; T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle; T1606 Forge Web Credentials
Command and Control
T1090 Proxy; T1102 Web Service
Collection
T1185 Browser Session Hijacking
Execution
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1585 Establish Accounts; T1608 Stage Capabilities
stealth
Affected products and versions in Browser-Level Phishing Attack-Flow Evasion
- Microsoft — Microsoft 365 / Entra ID (Azure AD) identity sign-in
Vulnerable versions: all MFA flows not using phishing-resistant FIDO2/WebAuthn
Fixed in: FIDO2/WebAuthn passkey, token binding / CAE enforced - Generic — Web-based identity providers and SaaS login portals
Vulnerable versions: OTP/push/SMS MFA susceptible to AiTM session-cookie theft
Fixed in: origin-bound phishing-resistant authentication
Remediation for Browser-Level Phishing Attack-Flow Evasion
Immediate actions
- Adopt browser-level / in-browser URL analysis (e.g. ANY.RUN interactive sandbox) for phishing triage instead of static-only URL and file scanning
- Treat post-load DOM mutations, injected client-side scripts and unexpected iframe activations on login pages as high-fidelity phishing indicators
- Hunt authentication logs for session-cookie reuse from new IP/geo/device shortly after a successful MFA sign-in (AiTM session replay)
Workarounds
- Block known PhaaS/open-redirect infrastructure and newly registered look-alike domains at the secure web gateway
- Strip or sandbox links through a rewrite/detonation proxy that renders the page server-side before delivery
Longer-term hardening
- Deploy phishing-resistant MFA (FIDO2/WebAuthn passkeys) which binds authentication to origin and defeats AiTM reverse-proxy session theft
- Enforce conditional-access policies with device compliance and token-binding / continuous access evaluation to invalidate stolen session cookies
- Build detection content keyed on runtime DOM artifacts and redirect-chain telemetry rather than static URL reputation alone
Weaknesses (CWE) in Browser-Level Phishing Attack-Flow Evasion
CWE-1021, CWE-451, CWE-601
Timeline of Browser-Level Phishing Attack-Flow Evasion
- Microsoft documents large-scale AiTM phishing campaigns using reverse-proxy infrastructure to steal session cookies and bypass MFA, establishing the attack-flow class that browser-level analysis targets.
- Microsoft details multi-stage AiTM phishing intrusions (Storm-1167) that chain stolen session cookies into downstream BEC and payment fraud, extending the reverse-proxy attack-flow class that browser-level inspection is built to reconstruct.
- Commercial PhaaS kits (EvilProxy, Greatness) and open-source Evilginx commoditize AiTM reverse-proxy phishing, rewriting all references to legitimate domains across HTML/JS/CSS/headers/cookies.
- Tycoon 2FA and Mamba 2FA emerge as dominant AiTM PhaaS offerings, heavily using layered redirects, CAPTCHA/Turnstile gating and post-load DOM injection to evade static URL and file analysis.
- ANY.RUN documents that the in-browser inspection exposes a runtime HTTP request log, redirect-hop chain, iframe activation map and an HTML DOM Changes tab, letting analysts pivot from a single phishing URL to the full post-load execution and credential-harvesting form interaction.
- GBHackers and CyberPress report the capability, noting browser-level evidence (redirects, DOM changes, injected scripts) and a single YARA rule surfacing 14 related phishing samples from the threat-intelligence corpus.
- ANY.RUN releases in-browser data inspection for its Interactive Sandbox, capturing the full execution tree, runtime HTTP requests, redirect hops, iframe activations and an HTML DOM Changes tab that deobfuscates injected post-load code.
- Cyber Security News publishes 'In-Browser Data Inspection Lets Analysts Track Phishing Attack Flow', describing per-URL triage time dropping from up to one hour to seconds with SOC-ready evidence packages.
- Threadlinqs Intelligence documents the browser-only phishing attack-flow evasion class and associated AiTM TTPs for detection engineering and threat hunting.
Sources cited for Browser-Level Phishing Attack-Flow Evasion
- In-Browser Data Inspection Lets Analysts Track Phishing Attack Flow
- ANY.RUN Sets a New Standard for URL Analysis (In-Browser Data Inspection)
- ANY.RUN Adds In-Browser Data Inspection to Reveal Phishing Redirects and DOM Changes
- ANY.RUN Interactive Sandbox Adds Browser-Level Evidence for Faster Phishing Triage
- MITRE ATT&CK T1557 — Adversary-in-the-Middle
- MITRE ATT&CK T1539 — Steal Web Session Cookie
- MITRE ATT&CK T1566.002 — Phishing: Spearphishing Link
- MITRE ATT&CK T1185 — Browser Session Hijacking
Threats related to Browser-Level Phishing Attack-Flow Evasion
- ChatGPT Plus Billing Phishing Campaign Spoofs Stripe Checkout to Harvest Payment Card Data
- AT&T-Themed Phishing Campaign Abuses Open Redirect Vulnerability (noSuchEntryRedirect) to Harvest SSN, Credit Card, and CVV Data
- Nested Triple-Chain Google Domain Phishing — Microsoft SafeLinks -> meet.google.com/linkredirect -> google.com/url -> adservice.google.com.ph Evades SEGs and Lands M365 Credential Theft Plus OAuth 2.0 Device-Code Phishing (KnowBe4 ThreatLabs Nested Delivery Matrix)
- Text-Salting Phishing Campaigns Abuse CSS-Hidden Text to Evade AI Email Security Filters
Detection coverage for TL-2026-0924
As of 2026-06-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0924 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.