Gotta Phish 'Em All Novel Attack Techniques via Persistent Browser in the Middle

The talk starts from the limits of current real-time phishing proxies. They drop requests during multi-factor challenges, lose visibility once a victim signs in, and allow little interaction after the initial capture. Browser-in-the-middle addresses this by sharing an attacker-controlled remote browser with the victim, so the victim authenticates inside that browser. The speaker also lists gaps in earlier public proofs of concept, including single-victim design, weak stability, limited modularity, and lost sessions after logout, and explains how the new work addresses them.

The core techniques combine a low-latency streaming layer with dynamic resolution and a replaced cursor, a bidirectional WebSocket channel that can alter page DOM, push JavaScript, or deliver files, and a hardened Firefox kiosk profile. Firefox extensions read cookies and local storage, log keystrokes, rewrite in-flight data, and intercept downloads so a modified file can be sent back. A logout handler clears cookies in the attacker's browser while the victim sees a normal sign-out, so the session stays usable. Live demonstrations cover a Google sign-in, a Drive file swap, a click-fix clipboard delivery, a fake camera prompt, and a fetch-based port scan from the victim's machine.

For defenders, the speaker points to signals such as unusual WebSocket traffic, sign-ins from distant locations within a short time, and client-side DOM changes. Planned work includes real-time password manager spoofing, Chrome support, and AI-driven phishing flows. The open-source release of the core framework, with its dashboard, base modules, and extensions, was announced for after the talk.