Maninthebrowser

Man-in-the-browser (MitB) is a form of malware that infects web browsers to intercept, modify, or forge web page content, transactions, and credentials as they are entered or submitted. It operates at the client side within the browser process, enabling attackers to read and alter data before it reaches the intended website and, in some cases, to bypass security measures such as two-factor authentication.

Infection methods include drive-by downloads, phishing, social engineering, and bundled software. Once installed, MitB components hook into browser APIs or inject code into web pages, often using browser extensions, plugins, or rootkit techniques to persist and avoid detection. They may also perform keystroke logging, form grabbing, or screen capture to harvest credentials and payment data.

MitB is particularly associated with financial fraud. Attackers can modify online banking transactions, alter recipient details, change transfer amounts, or inject fake confirmation screens after a user submits a payment. Some variants attempt to capture one-time codes or tokens used for 2FA, making fraud harder to detect.

Prevention and defense include maintaining up-to-date software, using reputable security products, and employing defense-in-depth strategies. Additional best practices include browser hardening, disabling unnecessary plugins, using separate devices for sensitive banking, enabling multi-factor authentication with hardware tokens, and monitoring financial activity for anomalies. Banks and security vendors also deploy techniques to detect unusual browser behavior and web-inject activity.