Browser-in-the-Browser is a phishing technique that creates a fake login dialog inside a web page so it looks like a real browser window or sign-in prompt. The goal is to make the victim trust the page and enter credentials, MFA codes, or other sensitive data into an interface controlled by the attacker.
This matters because many cloud services authenticate through the browser, so a convincing fake window can bypass casual inspection and make a malicious login flow feel legitimate. Attackers often pair it with brand impersonation, lookalike URLs, or proxy-based tricks such as adversary-in-the-middle setups that relay a real sign-in and capture usable session data. Defenders reduce the risk with phishing-resistant authentication, careful URL checking, conditional access, and user training that emphasizes looking for the real browser chrome, not just the content inside the page.