New Phishing Attack Using Browser-In-The-Browser Technique To Attack Gamers

A sophisticated new phishing campaign has emerged targeting the gaming community, specifically Counter-Strike 2 players, using an advanced technique known as Browser-in-the-Browser (BitB).

This attack method creates a convincing fake browser pop-up window that tricks users into entering their Steam credentials, allowing cybercriminals to steal valuable gaming accounts and virtual items.

The campaign primarily targets fans of professional esports team Navi (Natus Vincere), luring victims with promises of free in-game items, skins, and cases.

Attackers have established multiple phishing domains with names suggesting connections to the popular team, including variations like “caseneos[.]cfd” and “caserevs[.]com”.

These sites are promoted through social media and YouTube videos promising free Counter-Strike 2 skins.

Silent Push researchers noted this attack in March 2025, noting that the phishing operation appears to originate from Chinese threat actors, with some sites displaying content in Mandarin alongside English elements.

The researchers observed hundreds of similar domains using identical templates, suggesting a large-scale, coordinated campaign.

The Browser-in-the-Browser technique represents a particularly deceptive form of phishing.

Unlike traditional phishing that simply mimics website designs, BitB creates a fake browser window within the victim’s legitimate browser.

This includes spoofing browser UI elements like the address bar, security padlock icon, and window controls.

When users click on what appears to be a Steam login button, they’re presented with this fake browser window displaying a convincing replica of the Steam login page.

Technical Analysis of the BitB Implementation

The technical sophistication of this attack lies in its visual deception.

The fake browser window is actually constructed using HTML and CSS to precisely mimic browser chrome elements.

When examining the attack closely, users would notice the URL in the fake address bar cannot be selected or modified, as it’s merely part of an image or styled HTML elements.

Furthermore, interactions with browser-specific features like bookmarks or extensions fail to produce expected results.

The attackers have implemented multiple detection evasion techniques, including domain rotation, with new phishing domains being registered almost daily.

Silent Push’s analysis revealed a dedicated IP address (77.105.161[.]50) hosting numerous phishing domains with identical HTML structure.

To protect against such attacks, gamers should verify URL authenticity by attempting to edit the address bar, check for HTTPS padlock functionality, and use Steam’s mobile app for QR code authentication rather than entering credentials directly into browser windows.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free