Phishing Attack Spoofs Facebook Login Page to Capture Credentials

Cybercriminals are using a variety of dishonest tactics in a sophisticated phishing effort aimed at Facebook users in order to obtain login information.

The attack begins with a malicious redirect that leads victims to a fraudulent website mimicking legitimate Facebook interfaces. Here, users encounter a fake CAPTCHA prompt designed to appear as a standard security verification step.

Upon interacting with this prompt, the site deploys a Browser-in-the-Browser (BitB) phishing tactic, which simulates an authentic Facebook login window within the browser itself.

This method creates a convincing overlay that replicates the visual and functional elements of the official Facebook login page, including branding, input fields for usernames and passwords, and even interactive elements like buttons and error messages.

The BitB approach is particularly insidious because it operates entirely within the victim’s current browser session, eliminating the need for pop-up windows that might trigger browser security warnings or user suspicion.