Browser-in-Browser (BitB) is a phishing technique that draws a fake login dialog inside a webpage so it looks like a real browser window. Attackers use HTML, CSS, and JavaScript to imitate browser chrome, locks, tabs, and address-bar cues. BitB is not a browser exploit; it is a visual spoof designed to make a forged sign-in prompt feel trustworthy.
Security teams care about BitB because it can capture passwords and one-time MFA codes directly from the victim. In real attacks, the fake window is often paired with brand impersonation or a cloned service page. Defenses include checking the real domain outside the page content, opening services directly, and using phishing-resistant authentication such as passkeys or hardware security keys. Users should treat any login box embedded in a page as suspicious.