A recent threat intelligence report highlights the emergence of a sophisticated cyberattack technique known as Browser-in-the-Middle (BitM), which allows hackers to hijack user sessions across various web applications in a matter of seconds.
This method exploits the inherent functionalities of web browsers to deceive victims into believing they are interacting with a secure connection, while in reality, their actions are being performed on the attacker’s machine.
BitM attacks target session tokens, which are stored in a user’s browser after completing multi-factor authentication (MFA).
These tokens are crucial for maintaining an authenticated state, making them a prime target for adversaries.
Traditional methods, such as using transparent proxies like Evilginx2, require significant customization and can be time-consuming.
In contrast, BitM offers rapid targeting capabilities with minimal configuration, allowing hackers to reach any website quickly.
To counter these threats, organizations are advised to implement robust defenses.
Mandiant suggests using client certificates and hardware-based MFA solutions like FIDO2-compatible security keys.
These measures can effectively deter BitM attacks by requiring authentication elements that are difficult for attackers to manipulate.
For instance, FIDO2 keys ensure that authentication responses are tied to the request’s origin, preventing attackers from replaying them on different sites.
However, these protections are only effective if the device hosting the security keys or certificates remains uncompromised, emphasizing the need for a layered security approach.
The development of internal tools like Delusion by Mandiant demonstrates the potential scale of BitM attacks.
Delusion allows operators to target applications without prior knowledge of their authentication protocols, making session-stealing attacks more accessible.
While Mandiant has chosen not to publish Delusion due to weaponization concerns, open-source alternatives like EvilnoVNC and Cuddlephish are available for testing defenses against such threats.
As BitM attacks continue to evolve, organizations must prioritize robust authentication and access-control mechanisms to protect sensitive data and networks.
Are you from SOC/DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.
A new project has exposed a critical attack vector that exploits protocol vulnerabilities to disrupt…
A threat actor known as #LongNight has reportedly put up for sale remote code execution…
Ivanti disclosed two critical vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, affecting Ivanti Endpoint Manager Mobile…
Hackers are increasingly targeting macOS users with malicious clones of Ledger Live, the popular application…
The European Union has escalated its response to Russia’s ongoing campaign of hybrid threats, announcing…
Venice.ai has rapidly emerged as a disruptive force in the AI landscape, positioning itself as…