Threat reportPhishingTL-2026-3996
Browser Trust Abuse: Fake Update Lures, Browser-in-the-Browser, ClickFix and Device Code Phishing
Browser Trust Abuse (TL-2026-3996), also tracked as Browser Trust Abuse, is a high-severity phishing campaign, first published 2026-10-21. It has no confirmed attribution, affects Microsoft Microsoft Entra ID / Microsoft 365 (OAuth 2.0 device code, maps to 14 MITRE ATT&CK techniques (T1036, T1059.001, T1078.004), and is covered by 9 detection rules and 14 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-3996
- Threat ID
- TL-2026-3996
- Also known as
- Browser Trust Abuse
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- enterprise, construction, nonprofit, real estate, manufacturing, finance, health, legal, government administration
- Target regions
- Global, North America, Europe, Oceania
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in Browser Trust Abuse
Malware and tooling: Action1 RAT, Lumma Stealer - S1213, NetSupportManager RAT, Stealc, ConnectWise - S0591
How Browser Trust Abuse works
Cofense reports threat actors shifting from exploiting browser vulnerabilities to deceiving users through trusted browser workflows (login screens, software updates, authentication prompts). Four techniques are described: fake update/installation lures, Browser-in-the-Browser (BitB) fake sign-in windows, ClickFix fake verification pages leading to user-run PowerShell, and OAuth 2.0 device code phishing. They deliver ConnectWise, Action1 RAT, NetSupport Manager RAT and information stealers, or steal credentials and tokens.
Cofense Intelligence (blog dated 2026-08-26, author Marie Mamaril) describes a shift from exploiting browser software flaws to abusing the trust users place in browser interfaces. No CVE is involved. The attacks rely on social engineering inside the browser, so patching the browser does not address them.
Four techniques are described. (1) Software update and application installation lures mimic Adobe Reader, PDF viewers, productivity apps and browser extensions, and spoof the Chrome Web Store and Microsoft Store interfaces. They deliver RATs and information stealers. (2) Browser-in-the-Browser (BitB), a technique first publicised by researcher mr.d0x in March 2022, draws a counterfeit browser window in HTML/CSS (typically an iframe pointing at a phishing server) that imitates Microsoft, Google or Okta single sign-on pop-ups, so the visible URL bar is attacker-controlled. (3) ClickFix presents a fake browser verification or CAPTCHA page. Per Varonis, page script silently copies an obfuscated PowerShell command to the clipboard and instructs the user to press Win+R, Ctrl+V and Enter (Cofense also lists Windows Terminal as a target). Payloads documented for ClickFix by other vendors include Lumma Stealer, Stealc and NetSupport Manager RAT, often run in memory; mshta.exe is an alternative launcher. (4) Device code phishing abuses the OAuth 2.0 Device Authorization Grant (RFC 8628): the victim is sent to the legitimate Microsoft sign-in portal and enters an attacker-supplied code, which hands the attacker valid tokens. Cofense observed this trending from March to July 2026 with growing monthly distribution.
Supporting context from other sources: Microsoft documented Storm-2372 (assessed with moderate confidence as aligned with Russian interests) using device code phishing via fake Teams meeting invitations since August 2024. The actor later used the Microsoft Authentication Broker client ID to obtain Primary Refresh Tokens and register devices in Entra ID, then used Microsoft Graph to search mailboxes for keywords such as password, admin and credentials. A Cloud Security Alliance note describes commoditisation through the EvilTokens PhaaS (launched on Telegram 2026-02-16), which was used against 340+ Microsoft 365 organisations from 2026-02-19 to mid-March 2026, hosted on Railway.com with Cloudflare Workers and Vercel intermediaries. The Cofense article itself lists no domains, IPs, hashes or named actors, and the network IOCs below come from the CSA note on the EvilTokens campaign, which is a related campaign and not necessarily the same activity Cofense observed. Defence requires monitoring, identity protection, behavioral analytics and user education, plus blocking the device code flow through Entra ID Conditional Access. Severity is an analyst judgment; the source does not state one.
MITRE ATT&CK techniques used in TL-2026-3996
Defense Evasion
T1036 Masquerading; T1218.005 System Binary Proxy Execution: Mshta
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1204.002 User Execution: Malicious File; T1204.004 User Execution: Malicious Copy and Paste
Persistence
T1078.004 Valid Accounts: Cloud Accounts; T1098.005 Account Manipulation: Device Registration
Collection
T1114.002 Email Collection: Remote Email Collection
Command and Control
Credential Access
T1528 Steal Application Access Token; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
lateral-movement
T1550.001 Use Alternate Authentication Material: Application Access Token
Initial Access
Affected products and versions in Browser Trust Abuse
- Microsoft — Microsoft Entra ID / Microsoft 365 (OAuth 2.0 device code flow)
Vulnerable versions: Tenants permitting the device code flow
Fixed in: Tenants blocking the device code flow via Conditional Access - Microsoft — Windows (Run dialog, PowerShell, Windows Terminal)
Vulnerable versions: Endpoints where users can run PowerShell from the Run dialog - Multiple — Web browsers and SSO sign-in flows (Microsoft, Google, Okta)
Vulnerable versions: All browsers; no software flaw is exploited
Remediation for Browser Trust Abuse
Immediate actions
- Block the OAuth device code flow with an Entra ID Conditional Access policy (Authentication Flows condition, Device Code Flow, Grant: Block) except for approved scenarios
- Revoke refresh tokens and review registered devices for accounts suspected of device code phishing
- Alert on PowerShell, mshta.exe or Windows Terminal launched from the Run dialog or explorer.exe with encoded or download-cradle command lines
- Alert on installation of unapproved remote access tools (ConnectWise, Action1, NetSupport Manager)
Workarounds
- Allow software installs only from managed catalogs; block browser extension installs outside an allow-list
- Allow-list approved RMM tools and block all others at the proxy and EDR
Longer-term hardening
- Enforce phishing-resistant MFA (FIDO2 tokens, Windows Hello)
- Apply sign-in risk policies with automated responses
- Restrict the Windows Run dialog and PowerShell for standard users where feasible (Constrained Language Mode, application control)
- Run user awareness training on fake update prompts, fake CAPTCHA pages and sign-in pop-ups that cannot be dragged outside the browser window
- Use password managers, which do not autofill on spoofed BitB windows
Weaknesses (CWE) in Browser Trust Abuse
Timeline of Browser Trust Abuse
- Researcher mr.d0x publishes the Browser-in-the-Browser (BitB) technique for spoofing SSO pop-up windows; earlier use against Steam via fake CS:GO sites dates to 2020.
- Microsoft reports Storm-2372 device code phishing activity appearing to have been ongoing since August 2024, targeting governments, NGOs and other sectors.
- Microsoft Threat Intelligence publishes its analysis of Storm-2372 device code phishing using fake Teams meeting invitations; updated 2025-02-14 for the shift to the Microsoft Authentication Broker client ID.
- Cybereason GSOC discovers a ClickFix campaign using compromised WordPress sites to deliver NetSupport RAT (May 2025).
- EvilTokens device code phishing-as-a-service launches on Telegram, commoditizing the technique.
- Campaign hosted on Railway.com begins, reaching 340+ Microsoft 365 organizations in the US, Canada, Australia, New Zealand and Germany through mid-March 2026.
- Cofense observes device code phishing trending from March through July 2026, with growing monthly distribution.
- Cloud Security Alliance publishes a research note on the OAuth device code phishing campaign against 340+ Microsoft 365 organizations.
- Cofense publishes 'Understanding Browser Trust Abuse', describing fake updates, BitB, ClickFix and device code phishing delivering ConnectWise, Action1 RAT, NetSupport Manager RAT and stealers.
Sources cited for Browser Trust Abuse
- Understanding Browser Trust Abuse: Exploiting Enterprise's Most Trusted Interface (Cofense)
- Decoding ClickFix: Lessons from the Latest Browser-Based Phish (Varonis)
- Storm-2372 conducts device code phishing campaign (Microsoft Threat Intelligence)
- OAuth Device Code Phishing Hits 340+ Microsoft 365 Organizations (CSA Research Note)
- New Browser-in-the-Browser (BitB) attack (The Hacker News)
- Russian-linked hackers using device code phishing (The Hacker News)
- NetSupport RAT via WordPress sites using ClickFix (Cyber Security News)
Detection coverage for TL-2026-3996
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3996 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.