The malware’s evasion strategy centers on dynamic JavaScript that weaponizes the window.opener property, obliterating traditional origin checks before endpoint security tools can inspect the Document Object Model. The malware surfaced on 24 July 2025 when multiple redirection chains began populating social-media ads and compromised WordPress sites with a fake “Are you human?” prompt that routes through domains such as recaptcha-metahorizon[․]com and facefbook[․]com. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Gen Threat Labs analysts noted that the HTML automatically harvests username and password values through an injected onsubmit event, posting the credentials to an attacker-controlled API before refreshing the real facebook․com page to mask the breach. When embedded inside the spoofed iframe, the script also crawls for anti-bot artifacts—such as webdriver flags or sandboxed extensions—and aborts execution on detection, ensuring analysts receive a benign CAPTCHA loop. Once the user interacts, a perfectly skinned BitB window launches, complete with legitimate Facebook SSL indicators and an address bar snapshot captured via CSS to foster trust. The lure hinges on a deceptive CAPTCHA challenge that seamlessly morphs into a counterfeit Facebook session window, duping victims across desktops and mobile browsers alike. By limiting telemetry exports to POST requests and auto-tearing down fake domains within 60 minutes, the operators minimize network indicators and slip through signature-based web-gateways. Unlike earlier BitB efforts, this variant leverages cloud-hosted edge functions to rotate infrastructure hourly, frustrating block-lists and extending the dwell time of malicious hosts. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. Enterprises report secondary account takeovers and business-page hijacking that fuels payroll-diversion scams and ad-credit theft, amplifying the blast radius well beyond personal profiles. A rapidly evolving campaign is using a Browser-in-the-Browser (BitB) overlay to impersonate Facebook’s login and siphon user credentials.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 25 Jul 2025 10:05:13 +0000