Man-in-the-browser (MITB) Attack

MITB attacks are triggered by infection with Trojan malware that resides within the web browser. The malware first contacts the attacker's Command & Control (C&C) server to retrieve information, such as a list of target online banking sites. It then monitors the user’s activity and automatically detects access to a target site. A fake login interface is presented to the user, tricking them into entering their credentials. The attacker uses this information to carry out unauthorized actions, such as fraudulent money transfers, without the user's awareness.

Unlike MITM attacks, users in MITB scenarios are genuinely accessing the legitimate site, rendering server certificates and site identity verification ineffective. Additionally, since the unauthorized actions occur after the user logs in, even advanced authentication methods like one-time passwords are unable to prevent the attack. Tools for executing MITB attacks are readily available and their targets have expanded beyond online banking to include a wide variety of services.