Understanding Browser Trust Abuse: Exploiting Enterprise’s Most Trusted Interface

By: Marie Mamaril, Intelligence Team

The biggest change in browser-related threats is not a new flaw in browser software. It is a shift in how threat actors operate. Instead of breaking into the browser, they increasingly trick the people using it by exploiting the trust employees place in familiar browser experiences and workflows. By mimicking legitimate login screens, software update prompts, authentication requests, and security checks that people see every day, threat actors persuade users to disclose credentials, grant access to their computers, or install malware. As a result, any browser-enabled device can become a target, making browser patching alone insufficient to prevent these attacks.

Browsers have become the primary gateway to cloud applications through which users authenticate enterprise identities, access sensitive information, and conduct daily business operations. The concentration of sensitive data makes the browser a high-value target, and threat actors have adapted their methods accordingly.

This report examines four recent campaign types: fake software updates and application installation lures, Browser-in-the-Browser (BitB), ClickFix, and device code phishing. Rather than viewing these as separate attack techniques, the report presents a framework for understanding how threat actors exploit the person using the browser to steal credentials and install malware. Cofense Intelligence maintains a database of Active Threat Reports (ATR) within its ThreatHQ platform. These ATRs contain detailed analysis of the different Tactics, Techniques, and Procedures (TTPs), IOCs (indicators of compromise), and identification of various kinds of themed campaigns seen by the Threat Intelligence Analysts for both credential phishing and malware delivered via email.

Key Points

• This shift is demonstrated across diverse techniques, including ClickFix, fake browser updates, fake document viewers, Browser-in-the-Browser (BitB) and Device Code Phishing, which rely on trusted browser interactions instead of exploiting software vulnerabilities.
• Although these techniques differ in execution, they share a common objective: persuading users to perform actions that look like a normal part of using the browser.
• As browser-based attacks increasingly blend with legitimate user activity, distinguishing malicious behavior from normal operations becomes more challenging for traditional security controls.

Browser Trust Has Become the New Attack Surface

Historically, browsers were attractive targets because vulnerabilities within the browser could be exploited to compromise a user’s system. Defenders therefore focused on browser patching, exploit mitigation, and vulnerability management.

The way threat actors target browsers has changed considerably. Modern browsers are more secure, with exploit mitigations, incorporated sandboxing, automatic update cycles, and memory protection making successful browser exploitation increasingly difficult. While browser vulnerabilities still exist, exploiting them at scale has become increasingly difficult and costly. Rather than overcoming these technical defenses, threat actors have simply changed their approach. Instead of attacking the browser itself, they have taken advantage of the confidence users have in web browsers.

Today, users perform nearly every aspect of professional work through the browser, including email, cloud storage, collaboration, development environments, financial portals, and identity providers. This makes the browser more than an application; it functions as the user’s trusted workspace.

Modern browser-mediated attacks exploit users’ expectations that browser-prompted software installation pages, authentication windows, CAPTCHA checks, or document-viewer messages are legitimate. In this model, the browser is no longer the main target. Instead, it becomes the place where trusted interactions are turned into a delivery channel for deception.

Figure 1: Google-spoofing, meeting-themed emails deliver ConnectWise remote access tool (RAT) via an embedded URL from ATR 417483.

Four Browser Trust Abuse Campaigns 

The following campaigns abuse different forms of browser trust, but each is designed to make the user complete an action that provides threat actors with either direct access or credentials that can be used to gain access.

One common form of browser trust abuse Cofense Intelligence has observed is to exploit the confidence users place in software installation and update workflows. Although the visual presentation varies, the operational objective remains consistent: convincing users to install threat actor-controlled software through workflows that closely resemble legitimate software distribution processes. By abusing trust in software installation workflows, threat actors can deliver Information Stealers, abused RATs (as seen in Figure 3) or other payloads while appearing to follow expected application installation procedures.

Unlike historical "FakeUpdate" campaigns that primarily imitated browser updates, these modern campaigns illustrated in Figures 2 and 3 commonly impersonate Adobe Reader, PDF viewers, productivity applications, browser extensions, or trusted official software marketplaces such as the Chrome Web Store and Microsoft Store seen in Figure 4. Victims are informed that a document cannot be viewed, and an application requires updating, or a browser extension must be installed before they can continue. In short, threat actors now exploit user familiarity with everyday software installations, not just fake browser updates.

Fake Document Reader or Viewer update

Figure 2: Adobe-spoofing document viewer prompt used to convince users that a software update is required before delivering ConnectWise RAT from ATR 416945.

Figure 3: Adobe reader update-spoofing page that imitates a legitimate installation workflow to deliver Action1 RAT from ATR 417395.

Spoofed Microsoft or Chrome Store

Figure 4: Microsoft store-spoofing page designed to make a malicious ConnectWise RAT installer appear trustworthy from ATR 417483.

Browser-in-the-Browser (BitB)

Browser-in-the-Browser attacks exploit visual trust in familiar authentication interfaces. Instead of sending victims to a separate login page, threat actors render a convincing imitation of a browser pop-up or single sign-on window within the webpage itself. These fake windows often impersonate providers such as Microsoft, Google, or Okta and replicate expected browser elements, including the address bar and window controls. Because the prompt appears to match a normal authentication experience, victims may submit credentials without realizing the window is counterfeit.

Although no browser vulnerability is exploited, the attack successfully abuses the user's trust in common browser interfaces, demonstrating how visual deception alone can facilitate credential theft.

Figure 5: Browser-in-the-Browser phishing page that recreates a usual sign-in window within the browser to capture credentials from ATR 406199.

Figure 6: Another browser interface trust abuse using a Facebook-spoofing authentication window that uses familiar browser interface elements to increase user confidence in order to deliver Credential Phishing from ATR 418001.

ClickFix

ClickFix is one prominent browser trust abuse technique tracked and analyzed by Cofense Intelligence. It uses fake browser verification pages to instruct users to copy and run commands through PowerShell, Windows Terminal, or the Windows Run dialog. Victims believe they are resolving a browser issue or completing a security check, while the requested action initiates the compromise.

The browser merely delivers the deception, and the compromise occurs because users trust the browser interface and voluntarily execute the requested commands.

Figure 7: After clicking on the fake CAPTCHA, the user is prompted with steps to download and run NetSupport Manager RAT from ATR 417564.

Threat actors are increasingly abusing legitimate authentication workflows rather than creating spoofed login pages.

As shown in Figure 9, beginning in March 2026 Cofense Intelligence identified a growing trend of threat actors abusing the OAuth 2.0 Device Authorization Grant, a legitimate authentication mechanism designed for devices with limited input capabilities. Instead of directing victims to a spoofed login page, threat actors instructed them to authenticate through Microsoft’s legitimate device authentication portal using a threat actor-supplied device code that will ultimately authorize the threat actors’ sessions.

Because authentication occurs on Microsoft's legitimate website using a valid browser session, the process appears trustworthy. After the victim successfully signs in, however, the threat actor gains authorization for the device session associated with the supplied code.

Figure 8: Device code phishing flow that directs users to a legitimate sign-in process portal while authenticating a threat actor-controlled session from ATR 416404.

Figure 9: Monthly percentage distribution of device code phishing campaigns from March to July 2026.

Conclusion

The four techniques examined in this report appear different on the surface, but they represent the same underlying problem: employees are increasingly deceived within the browser they trust for everyday enterprise activities. Addressing this challenge requires more than patching browser software; it requires protecting the trusted browser interactions that enable modern enterprise operations. Whether it is ClickFix, fake software application installation pages, Browser-in-the-Browser, or Device Code Phishing, the objective is the same: manipulate trusted browser prompts, software installation workflows, browser interfaces, and authentication processes to persuade users to perform actions that facilitate compromise.

Viewing these attacks through the Browser Trust Abuse framework reveals that they are not isolated techniques but part of a broader shift toward trust exploitation. As organizations continue moving critical functions to browser accessible platforms, browsers have become central to enterprise identity, software delivery, and authentication. Organizations must also protect the trusted interactions that occur within the browser through effective monitoring, identity protection, behavioral analytics, and user education.