Browser-in-the-Middle attack

What is a Browser in the Middle Attack? 

 A Browser-in-the-Middle (BitM) attack is a type of cyberattack where an attacker secretly intercepts and manipulates communication between a user’s web browser and the website they are trying to access. In essence, the attacker positions themselves as a proxy, standing between the user and the legitimate website. 

•  Initial Infection/Redirection: The attack often starts with a phishing attempt, where the victim is tricked into clicking a malicious link. This link can lead to the attacker’s controlled server, which then acts as the intermediary. 
• Transparent Browser Session: The attacker sets up a “transparent” remote browser on their infrastructure. The victim, unknowingly, interacts with this remote browser, while believing they are directly interacting with the legitimate website. It’s like the victim is using the attacker’s computer and browser without realizing it.
• Intercepting Data: Because the attacker controls the browsing session, they can intercept sensitive information the user enters, such as usernames, passwords, credit card details, and even authentication tokens. 
• Manipulating Content: The attacker can also manipulate the content displayed on the web page, injecting malicious code or scripts, or altering the website’s appearance to further deceive the victim or redirect them to other malicious sites. 
• MFA Bypass: BitM attacks are particularly concerning because they can potentially bypass even strong security measures like multi-factor authentication (MFA). This is because the attack targets the session token, which is stored after the user has successfully completed the MFA process.  

 

What is the difference between a Man-in-the-Middle (MitM) attack and a Browser-in-the-Middle (BitM) attack? 

A BitM attack involves malicious control of the browser environment itself—usually through malware, rogue browser extensions, or manipulated proxy settings. By contrast, a man-in-the-middle (MitM) attack involves intercepting or altering communication between the user and a legitimate service over the network, without compromising the user’s device or browser directly. 

How BitM Attacks Work: 

• The attacker compromises the browser on the user’s device. 

• They manipulate what the user sees or sends within the browser, even if HTTPS is used. 

• Can overlay fake forms, alter input fields, or silently exfiltrate data. 

Typical target layer:  Application layer (inside the browser) 

Key traits: 

• Requires control of or access to the user’s browser 

• Often bypasses Transport Layer Security protections because it happens after decryption 

• Very difficult for users to detect (user interface [UI] appears normal) 

 

Differences Between MitM and BitM attacks: 

Location of Attack 

• MITM: Between user and server (network-level) 

• BITM: Inside the user’s browser (device-level) 

Access Needed 

• MITM: Network path 

• BITM: User’s browser or device 

Encryption (TLS) Affected? 

• MITM: Yes, often targeted 

• BITM: No, but bypassed after decryption 

Visibility to User 

• MITM: Sometimes noticeable 

• BITM: Often invisible 

 

What are some examples of BITM attacks? 

Here are several real-world and conceptual examples of Browser-in-the-Middle (BITM) attacks, which exploit the user’s browser environment to manipulate or intercept web interactions after TLS decryption—often invisibly to the user: 

1. Malicious Browser Extensions 

Example: “DataSpii” Leak 

• In 2019, several Chrome and Firefox extensions were found exfiltrating personal and corporate data from users’ browsers. 

• Once installed, these extensions could: 

• Intercept form data (usernames, passwords, credit card info) 

• Monitor browsing activity 

• Inject or modify page content 

Why it’s BITM: 

The attack happens within the browser itself, and the user still sees a normal-looking page, unaware that data is being siphoned off in the background. 

 

2. Malware That Hooks the Browser 

Example: TrickBot with Browser Injection 

• TrickBot and other banking Trojans use browser hooking to manipulate what users see in their web browser. 

• For example, on a legitimate banking site: 

• The malware can inject extra fields like “confirm PIN” or “enter security code.” 

• It captures keystrokes or token values and sends them to attackers. 

Why it’s BITM: 

The browser is compromised on the endpoint, not the network. HTTPS is intact, but the attack manipulates input/output within the session. 

 

3. Reverse Proxy Phishing Kits 

Example: Evilginx / Modlishka 

• These tools set up proxy phishing pages that sit between the user and the real login page. 

• When a user visits the phishing URL: 

• They see the legitimate login page (via proxy). 

• The attacker harvests credentials and session cookies (bypassing MFA). 

Why it’s BITM: 

Although not installed in the user’s browser, the proxy acts as a “virtual browser-in-the-middle”, capturing and modifying traffic in real time during an active session. 

 

4. Proxy Auto-Configuration (PAC) File Attacks 

• Attackers trick the browser into using a malicious PAC file via phishing or malware. 

• The PAC file reroutes some or all web traffic through an attacker-controlled server. 

• This can bypass TLS protection by downgrading HTTPS or enabling content injection. 

Why it’s BITM: 

The browser is being misdirected by its own settings, often without the user’s knowledge. 

 

5. Overlay Attacks on Mobile Browsers 

• On Android devices, some malware creates fake overlays on top of legitimate apps or browser windows. 

• When users log into a banking app or webmail, the malware captures inputs or replaces buttons. 

Why it’s BITM: 

The attack happens at the UI layer within the user’s device, visually indistinguishable from the real browser interface. 

 

6. Clickjacking (UI Redress Attacks)

• In clickjacking attacks, a malicious webpage uses transparent layers or hidden frames to trick users into clicking something they didn’t intend to. 

• For example, a fake “Play” button might sit over a hidden “Authorize payment” button on a real, embedded site. 

Why it’s BITM:
The attack hijacks user interaction within the browser session, manipulating what the user sees and does—without breaking encryption or requiring malware. 

 

Summary 

BITM attacks often evade traditional security controls because they exploit the trusted browser session—after encryption has already been decrypted. Whether through malicious extensions, injected scripts, or proxy manipulation, these attacks are dangerous because: 

• They’re difficult for users to detect 

• They bypass TLS and MFA 

• They undermine endpoint trust, not just network trust

 

How can companies ensure their networks are not breached by a BitM attack? 

 To protect against Browser-in-the-Middle (BitM) attacks, companies must recognize that these threats originate from compromised endpoints, not traditional network-layer vulnerabilities. Therefore, network-level defense alone is insufficient — the right approach involves a combination of endpoint protection, access control, visibility, and user education. 

Here’s how companies can ensure their networks are not breached via a BitM attack: 

 1. Implement Strong Network Access Control (NAC) 

• Use NAC solutions to verify device posture before granting network access. 

• Enforce policies that check for: 

• • Up-to-date browsers and operating systems 

• • Installed and active endpoint protection 

• • Absence of known malicious browser extensions 

Why it helps:
BitM attacks often rely on compromised devices. Blocking or restricting risky endpoints prevents the attack from reaching internal systems. 

 

2. Deploy Endpoint Detection & Response (EDR) Tools 

Use EDR to detect signs of browser manipulation, such as: 

• Script injection 

• Unusual browser behaviors 

• Credential harvesting activity 

Why it helps:
EDR provides real-time monitoring and response, especially for advanced threats that bypass traditional antivirus. 

 

3. Enforce Application-Aware Access Controls (Zero Trust) 

Use Zero Trust Network Access (ZTNA) or context-aware access to: 

• Authenticate both user and device 

• Monitor behavior during sessions 

• Restrict access if the device posture degrades (e.g., browser becomes infected) 

Why it helps:
BitM attacks often occur during authenticated sessions. Context-aware enforcement can revoke access mid-session if risk increases. 

 

4. Restrict or Manage Browser Extensions 

Use browser management tools (e.g., Chrome Enterprise, Microsoft Edge GPO) to: 

• Block unapproved extensions 

• Maintain allow-lists for safe add-ons 

• Enforce extension update policies 

Why it helps:
Rogue browser extensions are a common vector for BitM attacks. 

 

5. Use Phishing-Resistant MFA and Session Hardening

• Deploy FIDO2/WebAuthn-based MFA to prevent session hijacking 

• Implement passwordless authentication  

• Monitor for session cookie theft using behavior analytics or anomaly detection 

Why it helps:
Some BitM attacks harvest session tokens or intercept credentials during live sessions. Passwordless methods remove passwords from the equation and bind authentication to a device, while session hardening detects and limits post-login abuse. 

 

6. Inspect Traffic at the Application Layer (Decrypted TLS) 

Use secure web gateways or cloud access security brokers (CASBs) that inspect traffic for signs of: 

• Suspicious form field behavior 

• Credential leakage to unauthorized domains 

• Known BitM infrastructure (e.g., Evilginx signatures) 

Why it helps:
Network-layer visibility into application behavior gives security teams a way to detect attacks midstream. 

 

7. Train Users and Simulate Scenarios 

Educate users on: 

• The risks of installing unknown extensions 

• Recognizing suspicious overlays or browser behavior 

• Run simulated attacks or red-team exercises that mimic BitM techniques 

Why it helps:
User behavior is the first line of defense; awareness reduces successful social engineering and malware installs. 

 

Summary 

Companies can prevent BitM-based breaches by combining NAC, EDR, zero trust principles, and browser hygiene enforcement — all centered on the endpoint rather than the perimeter.