Phishing With Dynamite

Token stealing is getting harder. Instead, stealing whole logged-in browser instances may be an easier and more generic approach. One attack, known as “browser-in-the-middle” (BitM), makes it possible to virtually place a user in front of our browser and request them to log in for us. One of my old work buddies referred to it as “phishing with dynamite” after using it on a few social engineering campaigns.

Cuddlephish is an open-source, point-and-shoot implementation of BitM for penetration testers.

But …

article link nov phishing posts specterops stealing team token topic