[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBplKIPisid9TgGD6EcLdoiUURtW2_W7HPa3hGpZRTp0":3},{"article":4,"iocs":38,"watch_terms":55,"solutions":56,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"f3db49de-e0e5-4c5d-bbda-64d166858e49","Know Your Enemy: Browser-Based Attack Techniques in 2026","know-your-enemy-browser-based-attack-techniques-in-2026-239ba2","Given that the browser is where business apps are accessed and used, it makes sense that attacks are happening there too. Most breaches today begin in a browser session. Often, they never leave it, with the entire attack chain from initial access to exfiltration playing out in the browser. Here are the six most dangerous techniques that should be on every security team's radar in 2026. 1.","The article highlights six dangerous browser-based attack techniques security teams should monitor in 2026. These include advanced phishing that intercepts live sessions, malicious copy-paste commands tricking users into executing scripts, and authorization phishing that bypasses MFA by abusing OAuth mechanisms. Malicious browser extensions are also a significant threat, often becoming malicious after being acquired and updated by attackers.","Browser-based attacks are evolving with new techniques like AiTM phishing, malicious copy-paste, and OAuth abuse.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fknow-your-enemy-browser-based-attack.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjHy63Qp6WLBgRhCGaWARbZzjcdu6DhFo9JxZXTE9Rt4B42ImiW_cB0Fdq2yV_HYiZohMmVMRxTu1DxcbiOE9GNu4lAF2HZZ61QiCrWSEKGJFjEt5E5pKpXhjGK9DsZrqTxHFqF2IIaToRSTItghSELEiA_kgTP69_iOwbHdT35ht3yLCqIiNb5ysgDeuM\u002Fs1600\u002Fpush-phish.jpg","2026-09-30T11:58:00+00:00","2026-09-30T14:00:23.427659+00:00",8,[17,20,22],{"name":18,"type":19},"Claude Code","product",{"name":21,"type":19},"NotebookLM",{"name":23,"type":24},"APT29","threat_actor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":25,"icon":27,"name":28,"slug":29},null,"Threat Intelligence","threat-intelligence",[31,36],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},[39,42,44,46,49,52],{"type":35,"value":40,"context":41},"Tycoon2FA","Reverse-proxy adversary-in-the-middle (AiTM) phishing kit.",{"type":35,"value":43,"context":41},"Sneaky2FA",{"type":35,"value":45,"context":41},"Evilginx",{"type":35,"value":47,"context":48},"ClickFix","Malicious copy-and-paste technique.",{"type":35,"value":50,"context":51},"InstallFix","Variant of ClickFix using malvertised fake install pages.",{"type":35,"value":53,"context":54},"ConsentFix","Hybrid ClickFix-OAuth technique.",[18,21],{"controls":57,"vendors":145},[58,87,116],{"slug":59,"name":60,"problem":61,"products":62},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":88,"name":89,"problem":90,"products":91},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":117,"name":118,"problem":119,"products":120},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",[146],{"slug":147,"name":148,"logo_path":149,"roles":150},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[151],"reported_by",{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":170},"browser-based-attacks-in-2026-phishing-extensions-oauth-abuse","Browser-Based Attacks in 2026: Phishing, Extensions & OAuth Abuse","Modern browser-based attacks have evolved far beyond simple phishing links, now encompassing live session interception, clipboard-hijacking script execution, and OAuth mechanism abuse that renders MFA ineffective. A critical blind spot for many organizations is the supply chain risk posed by browser extensions — legitimate tools can be silently weaponized after acquisition by malicious actors and pushed to users via automatic updates. These techniques exploit user trust in familiar interfaces and browser ecosystems, meaning technical controls alone are insufficient without strong user education. The convergence of social engineering and technical exploitation makes these threats particularly dangerous, as a single user action can bypass layered defenses. Organizations that fail to govern browser environments and educate users on these evolving tactics face significant risk of credential theft and full account compromise.",[157,158,159,160,161,162,163,164,165,166,167,168,169],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-63B: Digital Identity Guidelines (Phishing-Resistant MFA)","NIST CSF DE.CM-1: Network Monitoring","GDPR Article 32: Security of Processing","MITRE ATT&CK T1185: Browser Session Hijacking","MITRE ATT&CK T1176: Browser Extensions","MITRE ATT&CK T1550.001: Use Alternate Authentication Material – OAuth Tokens",{}]