Information has been published about a phishing method that allows the user to create the illusion of working with a legitimate authentication form by recreating the browser interface in an area displayed over the current window using an iframe. Previously, attackers tried to deceive users by registering similarly spelled domains or manipulating URL parameters, but with the proposed method, HTML and CSS are used to render elements at the top of the popup window that replicate the browser interface, including control buttons and an address bar that shows an address different from the actual content address.
Considering that many websites use authentication forms through third-party services supporting the OAuth protocol, and these forms are displayed in a separate window, generating a fake browser interface can mislead even experienced and attentive users. The proposed method, for example, can be applied on hacked or untrustworthy sites to collect users' password data.
The researcher who highlighted the issue has published a ready-made set of templates simulating the Chrome interface in both dark and light themes for macOS and Windows. The popup window is created using an iframe that is displayed over the content. To enhance realism, JavaScript is used to bind handlers that allow moving the fake window and clicking on the control buttons.
Source: opennet.ru
