1 in 2 arrive through channels other than email

This is your 2026 guide to the browser-based attack techniques behind today's biggest breaches, and why traditional security tools don’t detect them until it’s too late.

Malicious JavaScript runs

Browser payload triggered

Apps & accounts hijacked

Traffic looks legitimate

No malware in sandbox

Requests seem legitimate

No malware detected on device

User activity looks normal

Activity looks legitimate

Successful authentication

Web hosting & cloud infra

Web hosting & cloud infra

Attack channels — email, Slack and Teams, social DMs, SMS, ads, in-app messages, docs and invites, service desk and vishing — reaching an employee's browser. Only email passes through a secure email gateway; every other channel arrives uninspected.

An attacker vibe-coding their own tools sends a stream of attack traffic into an employee's browser, which connects on to an AI hub and the AI services behind it.

Attacks in the browser , not on it.

Exploiting the browser itself is way more expensive than buying a set of infostealer logs with stolen credentials and sessions, renting a phishing service, or just vibe-coding your own tool.

AI is making software exploits more accessible, but for well-resourced browser vendors it also makes them much easier to find and fix. This is already happening.

Identities can’t be patched in the same way as a software exploit. There’s a way in to pretty much every account (yes, even if you’re using passkeys). And most identity configurations fall way short of the ideal.

That’s why identity attacks remain one of the most useful tools in the attacker’s toolkit, and why the criminal ecosystem continues to double down on them.

Attacks on the browser are beyond most criminals — but attacks in the browser are within reach for all.

Chrome RCE bug bounty

More delivery channels, more techniques, more payloads, with controls lagging behind.

Malicious links delivered over many channels

Redirect chains through legitimate, trusted sites

Evolving payloads, rotating domains and infrastructure.

Deliver over non-email channel

Send emails from trusted apps

Don’t use known-bad domains — constant rotation

Evade malicious download detections through HTML smuggling

Client-side reassembly of complex encoded web pages bypasses traffic signatures

Rapid domain rotation effectively bypasses domain blocklists

RBI is designed to protect against exploits, not attacks happening inside the browser e.g. account takeover

RBI is typically activated based on domain and URL level indicators that attackers are routinely evading anyway

Evade malicious download detections through HTML smuggling, or fileless malware delivery methods like ClickFix

Most attacks now don’t touch the endpoint

When they do, methods like ClickFix enable stealthy malware execution

2 in 5 logins not protected by MFA, “ghost logins” circumvent SSO

Downgrade attacks can circumvent phishing-resistant auth

Many attacks like device code phishing are post-auth, meaning they succeed regardless of login controls e.g. passkeys

In-app exploitation blends in with normal user activity

Cloud logging is inconsistent from app to app, creating visibility gaps

Public breaches tell the story.

Browser-based techniques have been behind some of the biggest public cybercriminal campaigns and breaches of recent years. Attacks that make it into the public domain are in the minority, but give an indicator of the patterns of criminal behavior happening behind the scenes.

Push intercepts browser attacks in real time, before they hit the user

Phishing danger detected

The website you are trying to access is using phishing software that can steal your credentials

Phishing danger detected

This device code login was trying to hijack your account. Push blocked the attack

Phishing danger detected

The website you are trying to access is using phishing software that can steal your credentials

Phishing danger detected

Phishing kit detected and blocked. The sign-in window here is fake despite the legitimate-looking URL

Malicious OAuth grant blocked

This app is requesting permissions that would give an attacker access to your account

Phishing danger detected

The link you opened leads to a malicious page. Push has blocked it.

Malicious redirect blocked

An ad on this page attempted to redirect you to a malicious site.

Malicious extension blocked

This extension has been flagged as malicious and is known for stealing data and credentials

Malicious download blocked

This file matches an unauthorized file type and has been blocked.

Malicious copy event blocked

This page attempted to copy a malicious command to your clipboard.

Malicious OAuth grant blocked

This page tried to trick you into granting an attacker access to your account. Push has stopped the consent flow.

This session was used from an unrecognized device and has been signed out.

Change your password and enable MFA

Your password for this app was found in a breach. Your security team needs you to change it and register for multi-factor authentication to protect your account.

See how Push stops browser attacks

Attack in progress AiTM phishing Adversary-in-the-middle phishing uses a reverse proxy to sit between the victim and a legitimate login page, relaying credentials and MFA challenges in real time to steal the resulting session token. Blocked by Push How Push stops it Push detects AITM phishing pages behaviorally — analyzing page structure, script behavior, and credential-harvesting mechanics rather than relying on domain blocklists or known kit signatures Password protection blocks credential entry on pages that don't belong to that credential's identity provider

Adversary-in-the-middle phishing uses a reverse proxy to sit between the victim and a legitimate login page, relaying credentials and MFA challenges in real time to steal the resulting session token.

Push detects AITM phishing pages behaviorally — analyzing page structure, script behavior, and credential-harvesting mechanics rather than relying on domain blocklists or known kit signatures

Password protection blocks credential entry on pages that don't belong to that credential's identity provider

Attack in progress Device code phishing Device code phishing abuses the OAuth 2.0 device authorization flow — the attacker generates a legitimate device code and tricks the victim into entering it, granting the attacker a valid access token without ever touching the victim's credentials. Blocked by Push How Push stops it Push detects and blocks device code phishing kits, stopping the attack before the user completes the authorization flow Push delivers app-agnostic warnings during the device code authentication flow, alerting users before they authorize a device they don't control

Device code phishing abuses the OAuth 2.0 device authorization flow — the attacker generates a legitimate device code and tricks the victim into entering it, granting the attacker a valid access token without ever touching the victim's credentials.

Push detects and blocks device code phishing kits, stopping the attack before the user completes the authorization flow

Push delivers app-agnostic warnings during the device code authentication flow, alerting users before they authorize a device they don't control

Attack in progress BITM phishing BITM phishing uses screen sharing technology like noVNC to stream an image of their browser to the victim. In this scenario, the victim is tricked into logging in on the attacker's browser: a bit like handing them the laptop and having them sign in Blocked by Push How Push stops it Push detects BITM with the same behavioral detections as AITM and BITB, analyzing page behavior, user interaction, and indicators relating to known phishing kits running on the page Password protection blocks credential entry on pages that don't belong to that credential's identity provider

BITM phishing uses screen sharing technology like noVNC to stream an image of their browser to the victim. In this scenario, the victim is tricked into logging in on the attacker's browser: a bit like handing them the laptop and having them sign in

Push detects BITM with the same behavioral detections as AITM and BITB, analyzing page behavior, user interaction, and indicators relating to known phishing kits running on the page

Password protection blocks credential entry on pages that don't belong to that credential's identity provider

Attack in progress BITB phishing Browser-in-the-browser (BITB) attacks render a fake browser popup inside the page — complete with a spoofed address bar showing a legitimate login URL — so victims believe they're signing in through a real login form. Blocked by Push How Push stops it Push detects BITB phishing pages behaviorally — analyzing page structure, script behavior, and credential-harvesting mechanics rather than relying on domain blocklists or known kit signatures Password protection blocks entry of corporate credentials on pages that don't belong to the real identity provider, whatever URL the fake address bar displays

Browser-in-the-browser (BITB) attacks render a fake browser popup inside the page — complete with a spoofed address bar showing a legitimate login URL — so victims believe they're signing in through a real login form.

Push detects BITB phishing pages behaviorally — analyzing page structure, script behavior, and credential-harvesting mechanics rather than relying on domain blocklists or known kit signatures

Password protection blocks entry of corporate credentials on pages that don't belong to the real identity provider, whatever URL the fake address bar displays

Attack in progress Consent phishing Consent phishing tricks users into granting OAuth permissions to a malicious application, giving the attacker persistent API-level access to the victim's data without needing their password. Blocked by Push How Push stops it Push monitors and can block OAuth consent flows across 20+ authorization servers, recording client ID, scopes, and outcome in real time Security teams can manage and remove malicious OAuth apps from the Push console

Consent phishing tricks users into granting OAuth permissions to a malicious application, giving the attacker persistent API-level access to the victim's data without needing their password.

Push monitors and can block OAuth consent flows across 20+ authorization servers, recording client ID, scopes, and outcome in real time

Security teams can manage and remove malicious OAuth apps from the Push console

Attack in progress Social media phishing Social media phishing delivers malicious links through trusted platforms like — recruiter outreach, direct messages, and connection requests lead victims to phishing pages, malware downloads, or other payloads entirely outside email security's view. Blocked by Push How Push stops it Push detects the malicious destination behaviorally at the moment it loads — regardless of delivery channel, so links from DMs are caught just like email phishing, engines, and any other channel that leads to a malicious page in the browser Protection covers whatever the payload is: credential phishing, ClickFix-style clipboard hijacks, malicious OAuth grants, or file downloads

Social media phishing

Social media phishing delivers malicious links through trusted platforms like — recruiter outreach, direct messages, and connection requests lead victims to phishing pages, malware downloads, or other payloads entirely outside email security's view.

Push detects the malicious destination behaviorally at the moment it loads — regardless of delivery channel, so links from DMs are caught just like email phishing, engines, and any other channel that leads to a malicious page in the browser

Protection covers whatever the payload is: credential phishing, ClickFix-style clipboard hijacks, malicious OAuth grants, or file downloads

Attack in progress Malvertising Malvertising uses paid ads or display ads to place malicious links above legitimate results, directing victims to phishing pages or malware downloads, blending in with legitimate results. Blocked by Push How Push stops it Push detects the phishing destination page behaviorally, regardless of how the user arrived — whether via a ad, display ad, email, or any other channel

Malvertising uses paid ads or display ads to place malicious links above legitimate results, directing victims to phishing pages or malware downloads, blending in with legitimate results.

Push detects the phishing destination page behaviorally, regardless of how the user arrived — whether via a ad, display ad, email, or any other channel

Attack in progress Malicious extensions Malicious browser extensions either start as outright malicious or become compromised through supply chain attacks like ownership transfers and permission escalations, gaining broad access to browsing data and credentials. Blocked by Push How Push stops it Push inventories all browser extensions across the organization with full permissions analysis, giving security teams visibility into what's installed Malicious extension detection and blocking identifies and removes known-malicious extensions across any browser in the environment

Malicious browser extensions either start as outright malicious or become compromised through supply chain attacks like ownership transfers and permission escalations, gaining broad access to browsing data and credentials.

Push inventories all browser extensions across the organization with full permissions analysis, giving security teams visibility into what's installed

Malicious extension detection and blocking identifies and removes known-malicious extensions across any browser in the environment

Attack in progress File downloads Malicious file downloads deliver malware payloads through the browser via malicious and compromised webpages. Blocked by Push How Push stops it Push streams all file download events to SIEM with full metadata, giving security teams visibility into what's being downloaded and where from Configurable blocking rules prevent risky downloads based on file type, extension, file name patterns, browser profile, and user group

Malicious file downloads deliver malware payloads through the browser via malicious and compromised webpages.

Push streams all file download events to SIEM with full metadata, giving security teams visibility into what's being downloaded and where from

Configurable blocking rules prevent risky downloads based on file type, extension, file name patterns, browser profile, and user group

Attack in progress ClickFix ClickFix attacks use a variety of lures, like fake CAPTCHA pages, error messages, or install prompts to silently load malicious commands into the victim's clipboard and instruct them to paste and execute the payload, which typically installs an infostealer or remote access tool. Blocked by Push How Push stops it Push detects when a page silently writes malicious commands to the clipboard, identifying the technique regardless of the social engineering wrapper (fake CAPTCHAs, fake errors, fake install prompts) Detection covers the entire x-Fix family — ClickFix, FileFix, CrashFix, ConsentFix, and InstallFix — through a single technique-class detection

ClickFix attacks use a variety of lures, like fake CAPTCHA pages, error messages, or install prompts to silently load malicious commands into the victim's clipboard and instruct them to paste and execute the payload, which typically installs an infostealer or remote access tool.

Push detects when a page silently writes malicious commands to the clipboard, identifying the technique regardless of the social engineering wrapper (fake CAPTCHAs, fake errors, fake install prompts)

Detection covers the entire x-Fix family — ClickFix, FileFix, CrashFix, ConsentFix, and InstallFix — through a single technique-class detection

Attack in progress ConsentFix ConsentFix wraps OAuth consent abuse in a ClickFix-style lure — a fake verification page walks the victim through approving a malicious consent grant. Blocked by Push How Push stops it Push detects the fake verification pattern and page behavior behind ConsentFix lures, regardless of the social engineering wrapper Risky consent grants can be blocked at the point of authorization, and security teams can revoke malicious grants from the Push console

ConsentFix wraps OAuth consent abuse in a ClickFix-style lure — a fake verification page walks the victim through approving a malicious consent grant.

Push detects the fake verification pattern and page behavior behind ConsentFix lures, regardless of the social engineering wrapper

Risky consent grants can be blocked at the point of authorization, and security teams can revoke malicious grants from the Push console

Attack in progress Session hijacking Session hijacking occurs when an attacker steals a valid session token, typically via infostealer malware or phishing, and replays it from their own browser to take over an authenticated session. Blocked by Push How Push stops it Push injects a unique marker into every session originating from a Push-protected browser — if that session token later appears in an uninstrumented browser, it's confirmed stolen Browser sync detection catches corporate credentials syncing to personal browser profiles, closing a common token and credential leakage path

Session hijacking occurs when an attacker steals a valid session token, typically via infostealer malware or phishing, and replays it from their own browser to take over an authenticated session.

Push injects a unique marker into every session originating from a Push-protected browser — if that session token later appears in an uninstrumented browser, it's confirmed stolen

Browser sync detection catches corporate credentials syncing to personal browser profiles, closing a common token and credential leakage path

Attack in progress Credential stuffing Credential stuffing uses stolen username-password pairs from breached databases and infostealer logs to attempt logins at scale, exploiting password reuse across services. Blocked by Push How Push stops it Push detects when employees log in with weak, reused, or breached passwords that have appeared in infostealer logs, enabling remediation before they become attack vectors MFA enforcement via in-browser guardrails ensures employees enroll in MFA, closing the gaps that credential stuffing relies on

Credential stuffing uses stolen username-password pairs from breached databases and infostealer logs to attempt logins at scale, exploiting password reuse across services.

Push detects when employees log in with weak, reused, or breached passwords that have appeared in infostealer logs, enabling remediation before they become attack vectors

MFA enforcement via in-browser guardrails ensures employees enroll in MFA, closing the gaps that credential stuffing relies on

Browser security that detects and blocks the attacks in this report in real time, before compromise.