Hackers use Browser-in-the-Browser attacks to steal Steam accounts

Do Son September 14, 2022 2 minutes read

According to a research report released by security firm Group-IB, there has been an increasing number of recent cases of phishing of Steam players through Browser-in-the-Browser technology, mostly affecting Steam players. These player accounts were stolen and sold on the black market for $100,000 to $300,000. Some players suffered heavy losses, so Steam players should pay attention to this issue to avoid being phished.

Hackers impersonate some well-known gaming tournaments to invite targeted Steam accounts to participate in so-called tournaments. The hacker’s own website imitates the websites of various competitions, and players must log in to their Steam accounts if they want to sign up.

When you click to log in, the website will pop up the official Steam login address (in fact, it is fake), which is nested in your browser windows by hackers using iframes.

Once the player enters their credentials, a new form prompts them to enter the 2FA code. After logging in, the player must also provide a 2FA verification code. Once the account authority is provided, the hacker will control it, and then the information will be changed so that the real player cannot control his account.

Group-IB claims that phishing attacks through Browser-in-the-Browser technology are increasing, not just against Steam, but also against other users such as business users. Hackers forge fake Google and Microsoft account login windows for phishing, which can be said to be hard to prevent for many non-professional users.

Browser-in-the-browser phishing differs significantly from traditional phishing:

Traditional phishing	Browser-in-the-browser phishing
Displays a phishing data entry form or redirects users to it.	Displays a data entry form in a pop-up browser window.
The address bar displays a URL that differs from the legitimate one. It is therefore obvious to users that entering confidential information on this website is not safe.	The address bar contains the URL of a third-party website that the victim wants to visit. The URL in the pop-up window is identical to the legitimate one.
The phishing resource cannot have an SSL certificate.	The fake window always displays an SSL certificate lock symbol.

Support Our Threat Intelligence

Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.

Support Our Threat Intelligence

Get Zero-Hour Vulnerability Alerts

Do Son