Browser-Level Phishing Attack-Flow Evasion: Layered Redirects, Injected Scripts, Iframe AiTM and Credential-Harvesting DOM Manipulation — Threadlinqs Intelligence
As of 2026-06-24, Browser-Level Phishing Attack-Flow Evasion: Layered Redirects, Injected Scripts, Iframe AiTM and Credential-Harvesting DOM Manipulation is a medium-severity phishing threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 16 indicators of compromise.
Threat ID: TL-2026-0924 · Severity: MEDIUM · Status: ACTIVE · Category: PHISHING
Modern URL phishing increasingly hides its kill chain behind dynamic, browser-only behavior — layered redirect chains, client-side injected scripts, iframe activations and credential-harvesting forms
This entry documents the phishing-evasion attack-flow class that browser-level (in-browser) data inspection is purpose-built to detect, and the defensive analysis capability ANY.RUN released in June 2026 to close that visibility gap.
Static URL and file analysis inspects only the initial response: the landing HTML, headers, and any directly linked files. Modern phishing operations defeat this by deferring all malicious behavior to runtime, inside the victim's browser. A single phishing URL typically resolves through a layered redirect chain (URL shorteners, open redirects on trusted domains, CAPTCHA/Cloudflare-Turnstile gates, and conditional geo/UA filtering) before reaching the final credential-harvesting page. The final page renders benign static HTML, then mutates: client-side JavaScript injected after page load rewrites the DOM, activates hidden iframes, and assembles the fake login form dynamically. Because the malicious form, branding, and exfiltration logic only exist in the post-load DOM, network-only or file-only sandboxes capture nothing actionable.
The most damaging variant is adversary-in-the-middle (AiTM) phishing (MITRE ATT&CK T1557). Instead of a static credential-collecting page, the phishing site is a reverse proxy (Evilginx-class) sitting transparently between the victim and the genuine identity provider. The victim authenticates against the real login flow — including completing MFA — while the proxy relays every request and captures the resulting authenticated session cookie (T1539, Steal Web Session Cookie) and credentials (T1056.003, Web Portal Capture). Replaying the stolen session cookie (T1606.001, Forge Web Credentials) grants the attacker an authenticated session and fully bypasses MFA (T1111). Commercial Phishing-as-a-Service (PhaaS) kits — Tycoon 2FA, EvilProxy, Mamba 2FA, Greatness, NakedPages — and the open-source Evilginx framework have commoditized this technique, rewriting every reference to the legitimate domain across HTML, JavaScript, CSS, headers and cookies so the proxy is invisible to the victim.
ANY.RUN's in-browser data inspection executes the suspected URL in a full interactive browser and records everything that matters in one view: the complete execution tree from initial URL to final rendered page (highlighting every redirect hop and iframe activation), the runtime HTTP requests, and a dedicated HTML DOM Changes tab that diffs and deobfuscates code fragments added to the DOM after load (green lines mark newly injected code). Indicators — domains, IP addresses and file hashes — are collected automatically, and analysts can draft YARA rules against specific phishing DOM artifacts and run them across ANY.RUN's threat-intelligence corpus to pivot to related samples; the source reports a single YARA rule surfacing 14 related phishing samples. The vendor reports per-URL triage time falling from up to one hour of manual work to seconds, producing SOC-ready evidence packages (redirect chains, screenshots, DOM artifacts) for escalation.
This is defensive analysis tooling and a generic technique profile, not a discrete tracked campaign: there is no single CVE, named actor, or campaign-specific IOC set. The value is in encoding the attack-flow TTPs and the behavioral/DOM indicators so SOC analysts, threat hunters and detection engineers can build runtime-aware detection for browser-only phishing evasion.
Weaknesses (CWE)
CWE-1021, CWE-451, CWE-601
Target sectors: financial, government, healthcare, technology, professional services, education
Target regions: Global, North America, Europe
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 16 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
PHISHING, MEDIUM, threat intelligence, cybersecurity, T1583, T1584, T1608, T1585, T1566, T1566, T1204, T1656, T1027, T1140