Fake-Fenster-Gefahr: Browser im Browser: Vorsicht vor neuartiger Phishing-Masche

Fake-Browser windows inside the browser, a novel phishing technique to trick users into disclosing sensitive information, has been discovered by security researchers. These deceptive windows appear convincingly real, complete with correct website addresses in their address bars, according to "Computer Bild". The campaign currently primarily targets businesses seeking AI assistance with tasks like creating advertising campaigns, customer acquisition, and budget management; however, this could change at any time.

The scheme works as follows: to make use of the offered services, users are asked to connect their accounts, such as Google accounts, with the respective AI service. Upon logging in, a falsified browser window opens within the website, displaying legitimate website addresses of providers like OpenAI, Google, etc. However, the user is still on the phishing site. The fake browser windows are generated to match the specific operating system and browser, making them hard to distinguish from legitimate ones.

Security experts note that such browser-in-browser phishing can be easily exposed: the fake window cannot be moved or resized outside of the browser as a real browser window can, so users should check for signs of a fake window, such as restrictions on moving or resizing, before entering sensitive data. Additionally, users should always critically examine unusual offers or promotional pages, including checking the legitimacy of the provider through a quick online search.

Finally, adopting passkeys as a passwordless and phishing-resistant authentication method for services is generally recommended, especially in this context.