WRAITH – Browser Hooking and Blind XSS Page Mirroring
WRAITH framework combines BeEF-style browser hooks with blind-XSS capture and page mirroring.
WRAITH is a new browser-hooking framework that merges BeEF-like command channels with blind-XSS evidence collection and a credentialed page mirroring feature. It allows operators to deploy modules to hooked browsers, capture page content, and navigate authenticated pages using the browser's existing session.
AI summary of the linked source. Not reviewed by an editor. How this works
Run WRAITH?
Get an email when a new story names WRAITH, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonWRAITH demonstrates how browser-hooking attacks can silently hijack authenticated sessions, mirror private pages, and exfiltrate data without triggering traditional endpoint defenses. The root problem lies in a combination of insufficient Content Security Policies, lack of output encoding that enables blind XSS injection, and users or developers unknowingly loading malicious scripts into trusted browser contexts. Because WRAITH leverages the browser's existing authenticated session, stolen credentials are not required — making detection far harder. This matters because any web application accepting user-supplied input without proper sanitization becomes a potential delivery vector, putting internal tools, admin panels, and sensitive authenticated content at risk of silent exfiltration.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.