Modern phishing techniques have evolved far beyond simple HTML pages, now employing sophisticated methods like Browser-in-the-Browser (BITB), Attacker-in-the-Middle (AITM), and WebRTC-based approaches; classic BITB still trips over 2FA, but AITM and WebRTC can bypass multi-factor authentication. These advanced techniques leverage cloud provider domains, complex infrastructure, and psychological manipulation to create highly convincing phishing campaigns that exploit human biases and technical vulnerabilities. The methodologies range from creating fake login pages with realistic animations to using open redirects on trusted domains, demonstrating an increasingly technical and nuanced approach to social engineering. BITB goes back to mr.d0x’s 2022 write-up, which fakes an entire OAuth sign-in pop-up, address bar included, using plain HTML, CSS, an iframe and a bit of JavaScript. The WebRTC variant builds on Forrest Kasler’s CuddlePhish, which streams a real attacker-controlled browser to the victim and replays their clicks and keystrokes with Puppeteer, though its author concedes it fails against hardware keys such as YubiKeys, which won’t authenticate to a domain they weren’t set up for.
