Red Team Members Only

Browser-in-the-Browser & Device Code Phishing

How modern phishing bypasses MFA: Browser-in-the-Browser overlays a fake browser window inside the real one — indistinguishable from a real OAuth popup — and Device Code Phishing abuses the OAuth device-code flow to steal tokens without any fake login page. Both hand attackers refresh tokens that survive password resets.

Related Articles