A new phishing toolkit created by a security researcher known as “mr.dox” has sparked conversations on a new type of phishing attack. The toolkit, called Browser in the Browser (BITB), attempts to create a popup phishing window that appears to look legitimate. Many websites use third-party accounts for single sign-on (SSO), such as Google or Facebook, to authenticate without having to create a new account. When this type of authentication is used on a legitimate website, a small popup window is opened that prompts the user for their credentials to the third party. The new attack uses this authentication flow to gather user credentials for the third-party websites. By using HTML, CSS, and Javascript, the tool creates a fake popup window inside the browser window that asks the user for their credentials. In the false window, everything from dragging the window, highlighting the URL, and the username and password fields work as expected. To test if a popup window is legitimate, users are expected to drag the window outside of the original webpage as this is currently the only way to detect the attack. While this attack has been seen in the wild as early as 2020, the new toolkit has brought the attack mainstream and allows penetration testers to easily test organizations using this technique.