# Browser Trust Abuse: Fake Update Lures, Browser-in-the-Browser, ClickFix and Device Code Phishing

> Cofense reports threat actors shifting from exploiting browser vulnerabilities to deceiving users through trusted browser workflows (login screens, software updates, authentication prompts). Four techniques are described: fake update/installation lures, Browser-in-the-Browser (BitB) fake sign-in windows, ClickFix fake verification pages leading to user-run PowerShell, and OAuth 2.0 device code phishing. They deliver ConnectWise, Action1 RAT, NetSupport Manager RAT and information stealers, or steal credentials and tokens.

- **Published:** 2026-10-21T01:40:26Z
- **Last reviewed:** 2026-10-21T01:40:26Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3996
- **ID:** TL-2026-3996
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Cofense Intelligence (blog dated 2026-08-26, author Marie Mamaril) describes a shift from exploiting browser software flaws to abusing the trust users place in browser interfaces. No CVE is involved. The attacks rely on social engineering inside the browser, so patching the browser does not address them.

Four techniques are described. (1) Software update and application installation lures mimic Adobe Reader, PDF viewers, productivity apps and browser extensions, and spoof the Chrome Web Store and Microsoft Store interfaces. They deliver RATs and information stealers. (2) Browser-in-the-Browser (BitB), a technique first publicised by researcher mr.d0x in March 2022, draws a counterfeit browser window in HTML/CSS (typically an iframe pointing at a phishing server) that imitates Microsoft, Google or Okta single sign-on pop-ups, so the visible URL bar is attacker-controlled. (3) ClickFix presents a fake browser verification or CAPTCHA page. Per Varonis, page script silently copies an obfuscated PowerShell command to the clipboard and instructs the user to press Win+R, Ctrl+V and Enter (Cofense also lists Windows Terminal as a target). Payloads documented for ClickFix by other vendors include Lumma Stealer, Stealc and NetSupport Manager RAT, often run in memory; mshta.exe is an alternative launcher. (4) Device code phishing abuses the OAuth 2.0 Device Authorization Grant (RFC 8628): the victim is sent to the legitimate Microsoft sign-in portal and enters an attacker-supplied code, which hands the attacker valid tokens. Cofense observed this trending from March to July 2026 with growing monthly distribution.

Supporting context from other sources: Microsoft documented Storm-2372 (assessed with moderate confidence as aligned with Russian interests) using device code phishing via fake Teams meeting invitations since August 2024. The actor later used the Microsoft Authentication Broker client ID to obtain Primary Refresh Tokens and register devices in Entra ID, then used Microsoft Graph to search mailboxes for keywords such as password, admin and credentials. A Cloud Security Alliance note describes commoditisation through the EvilTokens PhaaS (launched on Telegram 2026-02-16), which was used against 340+ Microsoft 365 organisations from 2026-02-19 to mid-March 2026, hosted on Railway.com with Cloudflare Workers and Vercel intermediaries. The Cofense article itself lists no domains, IPs, hashes or named actors, and the network IOCs below come from the CSA note on the EvilTokens campaign, which is a related campaign and not necessarily the same activity Cofense observed. Defence requires monitoring, identity protection, behavioral analytics and user education, plus blocking the device code flow through Entra ID Conditional Access. Severity is an analyst judgment; the source does not state one.

## MITRE ATT&CK

- T1566 Phishing
- T1566.002 Phishing: Spearphishing Link
- T1204.004 User Execution: Malicious Copy and Paste
- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1036 Masquerading
- T1218.005 System Binary Proxy Execution: Mshta
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1528 Steal Application Access Token
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1078.004 Valid Accounts: Cloud Accounts
- T1098.005 Account Manipulation: Device Registration
- T1114.002 Email Collection: Remote Email Collection
- T1219 Remote Access Tools

## Sources

- [Understanding Browser Trust Abuse: Exploiting Enterprise's Most Trusted Interface (Cofense)](https://cofense.com/blog/understanding-browser-trust-abuse-exploiting-enterprise-s-most-trusted-interface)
- [Decoding ClickFix: Lessons from the Latest Browser-Based Phish (Varonis)](https://www.varonis.com/blog/decoding-clickfix)
- [Storm-2372 conducts device code phishing campaign (Microsoft Threat Intelligence)](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)
- [OAuth Device Code Phishing Hits 340+ Microsoft 365 Organizations (CSA Research Note)](https://labs.cloudsecurityalliance.org/research/csa-research-note-oauth-device-code-phishing-m365-20260325-c/)
- [New Browser-in-the-Browser (BitB) attack (The Hacker News)](https://thehackernews.com/2022/03/new-browser-in-browser-bitb-attack.html)
- [Russian-linked hackers using device code phishing (The Hacker News)](https://thehackernews.com/2025/02/microsoft-russian-linked-hackers-using.html)
- [NetSupport RAT via WordPress sites using ClickFix (Cyber Security News)](https://cybersecuritynews.com/netsupport-rat-via-wordpress-sites)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3996