According to MITRE, Browser-in-the-Middle (BitM) is an attack where “an adversary exploits the inherent functionalities of a web browser, in order to establish an unnoticed remote desktop connection in the victim’s browser to the adversary’s system.” This attack has been used by many attackers to trick victims into unknowingly entering credentials and providing sensitive information on an attacker controlled window. The attack was first disclosed in a paper by researchers from the University of Salento in 2021, and we have seen many cases of BitM being used in the wild since then.
However, one key flaw of the BitM attack is that it still requires the victim to land on a malicious site and perform an action to open up the noVNC pop-up window. As the parent window still has a malicious URL in its address bar, this will likely raise suspicion among more security aware users at the point of credential entry.
SquareX’s research team has observed multiple instances of the browser’s FullScreen API being exploited to address this flaw by displaying a fullscreen BitM window that covers the parent window’s address bar, as well as a limitation specific to Safari browsers that makes fullscreen BitM attacks especially convincing. The article below will recap how BitM attacks work, explore the Fullscreen API requirements and why Safari browsers are particularly vulnerable to fullscreen BitM attacks.
Traditional Browser-in-the-Middle (BitM) Attacks
To illustrate how a typical BitM attack works, we will use a real attack that targeted Counter-Strike 2 gamers. Incentivized by cryptocurrency and skin giveaways, victims were tricked into entering their Steam credentials. These compromised accounts were then sold on the black market for up to $300,000. Here is how it works:
Note: The case study below actually used the Browser-in-the-Browser (BitB) technique, where instead of using remote desktop, the attackers uses HTML, CSS and JavaScript most commonly to mimic login pop-ups of popular SaaS or Single Sign-On (SSO) services. We chose this example as it is a well documented attack and because the social engineering and principles behind this attack can also be used in BitM attacks.
Detailed blueprints of Russia’s modernized nuclear weapon sites, including missile silos, were found leaking in public procurement database.
Russia is modernizing its nuclear weapon sites, including underground missile silos and support infrastructure. Data, including building plans, diagrams, equipment, and other schematics, is accessible to anyone in the public procurement database.
Journalists from Danwatch and Der Spiegel scraped and analyzed over two million documents from the public procurement database, which exposed Russian nuclear facilities, including their layout, in great detail. The investigation unveils that European companies participate in modernizing them.
According to the exclusive Der Spiegel report, Russian procurement documents expose some of the world’s most secret construction sites.
“It even contains floor plans and infrastructure details for nuclear weapons silos,” the report reads.
German building materials and construction system giant Knauf and numerous other European companies were found to be indirectly supplying the modernization through small local companies and subsidiaries.
Knauf condemned the Russian invasion of Ukraine and announced its intention to withdraw from its Russian business in 2024. Knauf told Der Spiegel that it only trades with independent dealers and cannot control who ultimately uses its materials in Russia.
Danwatch jointly reports that “hundreds of detailed blueprints” of Russian nuclear facilities, exposed in procurement databases, make them vulnerable to attacks.
“An enormous Russian security breach has exposed the innermost parts of Russia’s nuclear modernization,” the article reads.
“It’s completely unprecedented.”
The journalists used proxy servers in Russia, Kazakhstan, and Belarus to circumvent network restrictions and access the documents. The rich multimedia in the report details the inner structure of bunkers and missile silos.
Oasis Security's research team uncovered a flaw in Microsoft's OneDrive File Picker that allows websites to access a user’s entire OneDrive content, rather than just the specific files selected for upload via OneDrive File Picker. Researchers estimate that hundreds of apps are affected, including ChatGPT, Slack, Trello, and ClickUp–meaning millions of users may have already granted these apps access to their OneDrive. This flaw could have severe consequences, including customer data leakage and violation of compliance regulations.
Upon discovery, Oasis reported the flaw to Microsoft and advised vendors using OneDrive File Picker of the issue. In response, Microsoft is considering future improvements, including more precise alignment between what OneDrive File Picker does and the access it requires.
Below are details of the flaw and mitigation strategies. You can read the Oasis Security Research team’s full report here.
The Flaws
Excessive Permissions in the OneDrive File Picker
The official OneDrive File Picker implementation requests read access to the entire drive – even when uploading just a single file – due to the lack of fine-grained OAuth scopes for OneDrive.
While users are prompted to provide consent before completing an upload, the prompt’s vague and unclear language does not communicate the level of access being granted, leaving users open to unexpected security risks.
The lack of fine-grained scopes makes it impossible for users to distinguish between malicious apps that target all files and legitimate apps that ask for excessive permissions simply because there is no other secure option.
Insecure Storage of Sensitive Secrets
Sensitive secrets used for this access are often stored insecurely by default.
The latest version of OneDrive File Picker (8.0) requires developers to take care of the authentication themselves, typically using the Microsoft Authentication Library (MSAL) and most likely using the Authorization Flow.
Security risks ensue:
MSAL stores sensitive Tokens in the browser’s session storage in plain text.
With Authorization Flows a Refresh Token may also be issued, which lengthens the access period, providing ongoing access to the user's data.
Notably, OpenAI uses version 8.0.
Mitigation Steps
The lack of fine-grained OAuth scopes combined with Microsoft’s vague user prompt is a dangerous combination that puts both personal and enterprise users at risk. Oasis Security recommends that individuals and technology leaders review the third-party access they’ve granted to their account to mitigate the potential risks raised by these issues.
Check Whether or Not You’ve Previously Granted Access to a Vendor
How to for Private Accounts
Log in to your Microsoft Account.
In the left or top pane, click on "Privacy".
Under "App Access", select the list of apps that have access to your account.
Review the list of apps, and for each app, click on “Details” to view the specific scopes and permissions granted.
You can “Stop Sharing” at any time. Consider that an Access Token takes about an hour to expire regardless of when you clicked stopped sharing. This would however revoke a Refresh Token if present.
L'agence de cybersécurité américaine s'inquiète de la capacité des pirates à tirer parti d'une vulnérabilité sévère affectant Commvault pour voler des secrets d'environnements applicatifs SaaS dont Microsoft 365. La CISA enjoint les entreprises à appliquer les correctifs disponibles.
Régulièrement, la CISA lance des avertissement sur des failles exploitées. Selon un avis de l'agence de cybersécurité américaine, des acteurs malveillants pourraient avoir accédé à des secrets de clients à partir de la solution de sauvegarde Metallic Microsoft 365 de Commvault hébergée dans Azure. L'accès non autorisé à ces secrets a été réalisé grâce à un exploit zero day. En février, Microsoft a averti Commvault de l'existence d'une grave faille non spécifiée (répertoriée en tant que CVE-2025-3928) affectant sa solution Web Server. Par ailleurs, un acteur bénéficiant d'un soutien étatique l'exploitait activement pour accéder aux environnements Azure. Thomas Richards, directeur de la pratique de sécurité des infrastructures chez Black Duck, a déclaré que les flux SaaS sont intrinsèquement vulnérables. « Si les solutions SaaS déchargent les entreprises des tâches administratives liées à l'hébergement et à l'infrastructure, le revers de la médaille est que les sociétés n'ont aucun moyen de sécuriser ou de contrôler ces environnements », a-t-il déclaré. « Lorsque Commvault a été compromis, les victimes n'étaient même pas conscientes de l'existence d'une faille. »
Une CVE-2023-3928 sévère
Dans son avis, la CISA indique qu'elle soupçonne l'exploitation de CVE-2025-3928 de faire partie d'une campagne plus large visant les applications SaaS avec des paramètres par défaut et des autorisations de haut niveau. Commentant la note de la CISA, James Maude, Field CTO chez BeyondTrust, a déclaré : « Cela met en évidence les risques liés au fait de permettre à des tiers d'accéder de manière privilégiée à votre environnement, leur violation devenant votre violation [...] Alors que de nombreuses entreprises disposent de contrôles solides pour émettre et gérer l'accès aux comptes humains utilisés par les entrepreneurs et les tiers, l'histoire est souvent très différente lorsqu'il s'agit d'identités non humaines et de secrets qui permettent des interactions machine-machine. » D'après l'enquête de Commvault, les acteurs étatiques ont obtenu, par le biais d'un abus zero-day de CVE-2025-3928, un sous-ensemble d'identifiants d'applications que certains clients de Commvault utilisaient pour authentifier leurs environnements M365.
A LinkedIn message drew a former waitress in Minnesota into a type of intricate scam involving illegal paychecks and stolen data
Christina Chapman looked the part of an everyday American trying to make a name for herself in hustle culture.
In prolific posts on her TikTok account, which grew to more than 100,000 followers, she talked about her busy life working from home with clients in the computer business and the fantasy book she had started writing. She posted about liberal political causes, her meals and her travels to see her favorite Japanese pop band.
Yet in reality the 50-year-old was the operator of a “laptop farm,” filling her home with computers that allowed North Koreans to take jobs as U.S. tech workers and illegally collect $17.1 million in paychecks from more than 300 American companies, according to federal prosecutors.
In a June 2023 video, she said she didn’t have time to make her own breakfast that morning—“my clients are going crazy,” she said. Then she describes the açaí bowl and piña colada smoothie she bought. As she talks, at least 10 open laptops are visible on the racks behind her, their fans audibly whirring, with more off to the side.
In 2023, Christina Chapman posted a TikTok that had racks of laptops visible in the background. The Wall Street Journal highlighted the laptops in this clip of the video.
Chapman was one of an estimated several dozen “laptop farmers” that have popped up across the U.S. as part of a scam to infiltrate American companies and earn money for cash-strapped North Korea. People like Chapman typically operate dozens of laptops meant to be used by legitimate remote workers living in the U.S.
What the employers—and often the farmers themselves—don’t realize is that the workers are North Koreans living abroad but using stolen U.S. identities. Once they get a job, they coordinate with someone like Chapman who can provide some American cover—accepting deliveries of the computer, setting up the online connections and helping facilitate paychecks. Meanwhile the North Koreans log into the laptops from overseas every day through remote-access software.
Chapman fell into her role after she got a request on LinkedIn to “be the U.S. face” for a company that got jobs for overseas IT workers, according to court documents. There’s no indication that she knew she was working with North Koreans.
