Browser phishing is a phishing technique that displays a fake login or credential prompt inside the victim’s active browser session instead of sending them to a normal, stand-alone website. The page may be assembled from browser-generated content, an embedded frame, or a trusted cloud-hosted resource, which makes it look more legitimate and harder to spot with simple URL checks.
This matters because many defenses rely on stable indicators such as domain reputation, blocklists, and takedown requests. When the malicious page is ephemeral or hosted on trusted infrastructure, those controls lose some value. Defenders should look for unusual browser behavior, identity-provider anomalies, and suspicious message or link patterns. Browser protection, phishing-resistant MFA, and conditional access can help catch the attack earlier, especially when the fake page appears to match a familiar login flow but is not the real one.