6 browser-based attacks all security teams should be ready for in 2025

The article outlines six browser-based attack techniques that security teams should be ready for in 2025, arguing that the browser has become the new battleground and a primary route to compromises of business apps and data. It identifies the six key techniques as phishing for credentials and sessions, malicious code delivery via ClickFix and similar lures, malicious OAuth integrations, malicious browser extensions, malicious file delivery, and stolen credentials coupled with MFA gaps.

It notes that phishing now operates across multiple channels and can bypass some MFA, with attackers able to proxy the login process and observe in real time through browser visibility. It also highlights that ClickFix and its variants copy malicious code from a page’s clipboard and that malicious extensions can capture logins and session cookies, often passing security checks by updating existing extensions on users’ browsers.

The piece is sponsored content by Push Security and promotes their browser-based security platform as a means to detect and respond to these in-browser threats, urging organisations to observe and manage apps, extensions, and MFA configurations. According to Push Security.