A browser-to-shell handoff is the point where a web page or browser interaction leads a user into executing commands in a local terminal or shell. Instead of dropping a file or exploiting software directly, the attacker uses the page to persuade the victim to copy, paste, or launch a command through tools such as PowerShell, the Windows Run dialog, or a terminal window.
This matters because it turns social engineering into code execution. A convincing fake CAPTCHA, verification step, or support prompt can bridge the gap between harmless-looking web content and active compromise. For defenders, the key signal is behavioral: watch for browser activity followed by clipboard changes, Win+R use, PowerShell, mshta.exe, or other scripting tools. Blocking malicious domains helps, but detecting the handoff itself is often more effective because the browser is only the starting point of the attack.