Phishing & Scams

The Fake Login Window — How Browser-in-the-Browser Phishing Works

A convincing fake login popup can be drawn entirely inside a webpage, complete with a padlock icon and a real-looking URL. Here's how to spot it every time.

By AdsBlocks Team·October 29, 2026

The Fake Login Window — How Browser-in-the-Browser Phishing Works

The Attack That Defeats Your Eye

When you see a login popup with a green padlock and a URL that reads "accounts.google.com" or "login.microsoft.com," your instinct is to trust it. That instinct is exactly what browser-in-the-browser (BitB) phishing exploits.

The entire window — address bar, padlock icon, and all — is rendered inside a normal webpage using HTML, CSS, and JavaScript. It's not a real browser window. It's a picture of one.

How It Works Technically

You visit a malicious or compromised site

The page displays a "Sign in with Google" or similar button

Clicking it creates a div element styled to look like a browser popup

The fake address bar shows a legitimate-looking URL

The "padlock" is a Unicode character or SVG icon — it's decorative

Any credentials you enter go directly to the attacker

The attack was first publicly documented in 2022 but has become increasingly sophisticated. Modern implementations are nearly pixel-perfect replicas of Chrome, Firefox, and Safari login dialogs.

The One Test That Exposes Every BitB Attack

Try to drag the popup outside your browser window.

A real browser popup is its own operating system window — you can drag it anywhere on your screen, even off the browser entirely. A fake popup is a div element confined to the webpage's boundaries.

If you drag the popup and it stops at the edge of your browser window, it's fake.

Other Warning Signs

The popup appears without you navigating to a new address in your main browser bar

You cannot resize the "window" independently from the browser

The URL in the popup doesn't update your main browser's address bar

The popup appears in response to a button on a site you reached through an ad, email, or social media

Why Phishing Filters Don't Always Catch It

The page you're on when this popup appears is often a legitimate domain, or a freshly registered domain with no prior history of malicious activity. Many URL filters check the destination domain — but BitB attacks don't take you to a new domain, so there's no malicious URL to block.

Behavioral detection is what catches these attacks. Good security software analyzes the structure of the page and the elements being rendered, not just the URL.

How to Protect Yourself

Use a hardware security key for important accounts — even if your credentials are stolen, the attacker can't log in without the physical key

Look for the passkey option — Google, Apple, and Microsoft now support passkeys that don't have a username/password to steal

Always verify popups by dragging them — this takes two seconds and is 100% reliable

Use WebShield or similar browser protection — it monitors page behavior, not just URLs

Be skeptical of any "Sign in with" prompt that appears on a site you didn't explicitly navigate to for a login purpose

Bottom Line

Browser-in-the-browser phishing is designed to defeat the visual checks you've been trained to use. The drag test defeats it completely. Make it a reflex.

Protect Yourself Today

The #1-rated antivirus covers all the threats mentioned in this article.

Get TotalAV — $1.99/month →