# Browser-Level Phishing Attack-Flow Evasion: Layered Redirects, Injected Scripts, Iframe AiTM and Credential-Harvesting DOM Manipulation

> Modern URL phishing increasingly hides its kill chain behind dynamic, browser-only behavior — layered redirect chains, client-side injected scripts, iframe activations and credential-harvesting forms that static URL/file analysis never observes. ANY.RUN's in-browser data inspection executes suspect URLs in a real browser to capture the full execution tree (redirects, runtime DOM changes, network requests, injected code), exposing the adversary-in-the-middle (AiTM) and dynamic-evasion techniques that defeat conventional tooling and bypass MFA.

- **Published:** 2026-06-24T00:00:00Z
- **Last reviewed:** 2026-06-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0924
- **ID:** TL-2026-0924
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This entry documents the phishing-evasion attack-flow class that browser-level (in-browser) data inspection is purpose-built to detect, and the defensive analysis capability ANY.RUN released in June 2026 to close that visibility gap.

Static URL and file analysis inspects only the initial response: the landing HTML, headers, and any directly linked files. Modern phishing operations defeat this by deferring all malicious behavior to runtime, inside the victim's browser. A single phishing URL typically resolves through a layered redirect chain (URL shorteners, open redirects on trusted domains, CAPTCHA/Cloudflare-Turnstile gates, and conditional geo/UA filtering) before reaching the final credential-harvesting page. The final page renders benign static HTML, then mutates: client-side JavaScript injected after page load rewrites the DOM, activates hidden iframes, and assembles the fake login form dynamically. Because the malicious form, branding, and exfiltration logic only exist in the post-load DOM, network-only or file-only sandboxes capture nothing actionable.

The most damaging variant is adversary-in-the-middle (AiTM) phishing (MITRE ATT&CK T1557). Instead of a static credential-collecting page, the phishing site is a reverse proxy (Evilginx-class) sitting transparently between the victim and the genuine identity provider. The victim authenticates against the real login flow — including completing MFA — while the proxy relays every request and captures the resulting authenticated session cookie (T1539, Steal Web Session Cookie) and credentials (T1056.003, Web Portal Capture). Replaying the stolen session cookie (T1606.001, Forge Web Credentials) grants the attacker an authenticated session and fully bypasses MFA (T1111). Commercial Phishing-as-a-Service (PhaaS) kits — Tycoon 2FA, EvilProxy, Mamba 2FA, Greatness, NakedPages — and the open-source Evilginx framework have commoditized this technique, rewriting every reference to the legitimate domain across HTML, JavaScript, CSS, headers and cookies so the proxy is invisible to the victim.

ANY.RUN's in-browser data inspection executes the suspected URL in a full interactive browser and records everything that matters in one view: the complete execution tree from initial URL to final rendered page (highlighting every redirect hop and iframe activation), the runtime HTTP requests, and a dedicated HTML DOM Changes tab that diffs and deobfuscates code fragments added to the DOM after load (green lines mark newly injected code). Indicators — domains, IP addresses and file hashes — are collected automatically, and analysts can draft YARA rules against specific phishing DOM artifacts and run them across ANY.RUN's threat-intelligence corpus to pivot to related samples; the source reports a single YARA rule surfacing 14 related phishing samples. The vendor reports per-URL triage time falling from up to one hour of manual work to seconds, producing SOC-ready evidence packages (redirect chains, screenshots, DOM artifacts) for escalation.

This is defensive analysis tooling and a generic technique profile, not a discrete tracked campaign: there is no single CVE, named actor, or campaign-specific IOC set. The value is in encoding the attack-flow TTPs and the behavioral/DOM indicators so SOC analysts, threat hunters and detection engineers can build runtime-aware detection for browser-only phishing evasion.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1608 Stage Capabilities
- T1585 Establish Accounts
- T1566 Phishing
- T1204 User Execution
- T1684.001 Impersonation
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1557 Adversary-in-the-Middle
- T1056 Input Capture
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1606 Forge Web Credentials
- T1185 Browser Session Hijacking
- T1090 Proxy
- T1102 Web Service

## Sources

- [In-Browser Data Inspection Lets Analysts Track Phishing Attack Flow](https://cybersecuritynews.com/in-browser-data-inspection-lets-analysts-track-phishing-attack-flow/)
- [ANY.RUN Sets a New Standard for URL Analysis (In-Browser Data Inspection)](https://any.run/cybersecurity-blog/in-browser-data-inspection/)
- [ANY.RUN Adds In-Browser Data Inspection to Reveal Phishing Redirects and DOM Changes](https://gbhackers.com/any-run-adds-in-browser-data-inspection/)
- [ANY.RUN Interactive Sandbox Adds Browser-Level Evidence for Faster Phishing Triage](https://cyberpress.org/any-run-speeds-phishing-triage/)
- [MITRE ATT&CK T1557 — Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557/)
- [MITRE ATT&CK T1539 — Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539/)
- [MITRE ATT&CK T1566.002 — Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
- [MITRE ATT&CK T1185 — Browser Session Hijacking](https://attack.mitre.org/techniques/T1185/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0924