“Browser-in-the-Browser” Attack Escalates: Trellix Reports Surge in Sophisticated Facebook Phishing

On 15 January 2026, a Trellix report highlighted a surge in sophisticated Facebook phishing campaigns using a Browser-in-the-Browser (BitB) technique aimed at Facebook’s roughly 3 billion users. Observed escalating in the second half of 2025, the attacks combine advanced deception with trusted cloud infrastructure to bypass traditional security filters.

According to Trellix, the most dangerous evolution is the fake login pop-up created entirely within the victim’s existing browser tab, making the credential page appear legitimate while the URL bar is visually fabricated. The campaigns increasingly host phishing pages on reputable cloud platforms such as Netlify and Vercel, with attackers using URL shorteners like Lnk[.]ink and rebrand[.]ly to obscure the final destination.

Trellix notes that this multi-layered approach, including high-pressure social engineering, signals that standard user awareness training alone is no longer sufficient to spot such threats. Defenders are urged to adopt a multi-layered defence strategy that goes beyond simple visual checks to combat these technically complex campaigns.