SquareX has released new threat research detailing an advanced Browser-in-the-Middle (BitM) attack that specifically targets users of the Safari browser.
The research, conducted as part of the Year of Browser Bugs (YOBB) project, outlines the method by which BitM attacks deceive individuals into providing sensitive credentials by presenting fake login pages in the victim's browser through a pop-up window controlled by the attacker.
Traditionally, one limitation of BitM attacks has been the continued visibility of the malicious URL in the parent window, which could alert security-conscious users to the threat.
SquareX's research identifies a vulnerability in Safari's implementation of the Fullscreen API that attackers can exploit to make the attack more convincing and difficult to detect.
According to the team, "When combined with BitM, this vulnerability can be exploited to create an extremely convincing Fullscreen BitM attack, where the BitM window opens up in fullscreen mode such that no suspicious URLs from the parent window is seen. Safari users are especially vulnerable to this attack as there is no clear visual indicator of users entering fullscreen."
The researchers added, "We have disclosed this vulnerability to Safari and were regrettably informed that there is no plan to address the issue."
The Fullscreen API, as currently specified, requires only that "the user has to interact with the page or a UI element in order for this feature to work." However, it does not detail what type of interaction is necessary. Attackers can thus embed any clickable element, such as a fake login button, in the pop-up which triggers fullscreen mode, convincingly mimicking a legitimate login page with the real URL in the address bar.
SquareX's researchers warned: "The Fullscreen BitM attack highlights architectural and design flaws in browser APIs, specifically the FullScreen API. Users can unknowingly click on a fake button and trigger a fullscreen BitM window, especially in Safari where there is no notification when the user enters fullscreen mode."
"Users that typically rely on URLs to verify the legitimacy of a site will have zero visual cues that they are on an attacker-controlled site. With how advanced BitM is becoming, it is critical for enterprises to have browser-native security measures to stop attacks that can no longer be visually identified by even the most security aware individuals."
While BitM attacks have generally been used to steal login credentials, session tokens, and SaaS application data, the fullscreen variant described in SquareX's research further increases the risks by making detection by ordinary users extremely difficult. The attack could extend to spreading misinformation via fake pages designed to resemble official government sites, as well as gathering personally identifiable information (PII) and company data. Attackers could also open new tabs within the attacker-controlled window, gaining further insight into the victim's browsing activities.
Other browsers, including Firefox, Chrome, Edge, and Chromium-based ones, are also technically susceptible to the Fullscreen BitM attack. These browsers do issue a notification when fullscreen mode is activated, but the warning is described as subtle and easily overlooked. Dark mode and modified colour schemes can make the notification even less noticeable. In contrast, Safari only shows a brief swipe animation with no explicit messaging, which increases user vulnerability.
The research states that endpoint detection and response solutions lack the capability to monitor activity within the browser itself, rendering them ineffective against both standard and fullscreen BitM attacks. According to SquareX, "EDRs have zero visibility into the browser and are proven to be obsolete when it comes to detecting any BitM attack, much less its more advanced fullscreen variant. Additionally, orchestrating the attack with technologies such as remote browser and pixel pushing will also allow it to bypass SASE/SSE detection by eliminating any suspicious local traffic."
The researchers assert that security tools are currently unable to detect or mitigate Fullscreen BitM attacks due to the lack of access to detailed browser metrics. "As phishing attacks become more sophisticated to exploit architectural limitations of browser APIs that are either unfixable or will take significant time to fix by browser providers, it is critical for enterprises to rethink their defense strategy to include advanced attacks like Fullscreen BitM in the browser," the research team stated.
SquareX's disclosure of the Fullscreen BitM attack is part of its ongoing initiative to highlight browser vulnerabilities and architectural limitations as browser-based attacks continue to evolve. Previous disclosures under the Year of Browser Bugs project have addressed threats such as Browser Syncjacking, Polymorphic Extensions, and Browser-Native Ransomware.
