Safari Flaw Exploited by BitM Attack to Steal User Login Data

A new wave of phishing attacks, known as Fullscreen Browser-in-the-Middle (BitM) attacks, is exploiting browser features to steal user credentials with unprecedented stealth.

Unlike traditional phishing, which relies on fake websites and visible clues, BitM attacks leverage remote browser sessions and the Fullscreen API to create convincing overlays that mask all browser interface elements, including the critical address bar, making malicious activity nearly undetectable to victims.

BitM attacks work by tricking users into clicking a malicious link or button, often disguised as a login or promotional offer.

This action triggers a remote browser session, typically via tools like noVNC, which displays a legitimate login page from the real service provider.

However, the session runs in the attacker’s environment, allowing them to capture credentials, session tokens, and sensitive data as the victim interacts with the site.

Exploiting the Fullscreen API:

The Fullscreen API is a standard browser feature that enables web content to occupy the entire screen, hiding all browser chrome and operating system UI elements.

Attackers exploit this by calling the requestFullscreen() method on a crafted element after a user interaction, such as clicking a fake login button.

This method is supported across all major browsers, but with varying degrees of user notification.

Example JavaScript Code for Fullscreen API Exploitation:

javascriptconst elem = document.getElementById("login-window");
if (elem.requestFullscreen) {
    elem.requestFullscreen();
} else if (elem.webkitRequestFullscreen) { // Safari
    elem.webkitRequestFullscreen();
}

This code snippet demonstrates how an attacker might trigger fullscreen mode on a fake login window.

Once in full screen, the victim sees only the attacker-controlled content, with no visible URL or browser controls.

Method/Property	Description
requestFullscreen()	Opens an element in fullscreen mode
exitFullscreen()	Exits fullscreen mode
fullscreenElement	Returns the element currently in fullscreen
fullscreenEnabled	Returns true if fullscreen mode is available

The Weakest Link Among Browsers

While all browsers are technically vulnerable to Fullscreen BitM attacks, Safari is particularly exposed due to its lack of clear visual cues when entering fullscreen mode.

Chrome, Edge, and Firefox display brief notifications or domain-specific alerts when full screen is activated.

However, these warnings are subtle and can be easily missed, especially if attackers mimic their appearance or use dark mode color schemes.

Safari, on the other hand, only shows a fleeting swipe animation, offering no persistent or prominent indication that the browser has entered full screen.

Apple has confirmed this behavior is “working as designed” and has no plans to address it, leaving users especially vulnerable to sophisticated phishing campaigns.

Browser	Fullscreen Notification	Attack Effectiveness
Safari	Swipe animation only	High
Chrome/Edge	Brief message (can be hidden)	Moderate-High
Firefox	Domain alert (brief, subtle)	Moderate

The Need for Browser-Native Security Solutions

Traditional security tools—such as Endpoint Detection and Response (EDR) and Secure Web Gateways (SWG)—are ineffective against Fullscreen BitM attacks because they lack visibility into browser-level events and user interactions.

Attackers can host phishing sites on trusted domains (e.g., AWS, Vercel) to evade network-based detection, and the use of remote browsers eliminates suspicious local traffic.

Security researchers and vendors now advocate for browser-native detection and response solutions.

These tools operate as browser extensions, monitoring Document Object Model (DOM) changes, API usage, and user interactions to detect and mitigate advanced client-side attacks in real time.

As phishing techniques continue to exploit legitimate browser features, enterprises and end-users must adopt new defensive strategies to stay ahead of evolving threats.

In summary, Fullscreen BitM attacks represent a dangerous evolution in phishing, exploiting browser functionality rather than software bugs.

Until browser vendors address these architectural flaws, heightened vigilance and browser-native security tools are essential for protection.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!