Facebook login thieves now using browser-in-browser trick

Trellix researchers observed active phishing campaigns targeting Facebook users that employ the Browser‑in‑the‑Browser (BitB) technique — a fake, iframe‑based login pop-up — combined with legitimate cloud hosting and URL shorteners to evade detection and harvest credentials or personal data; lures include copyright notices, account suspension threats, and fake Meta security messages, with recommendations to navigate to official sites and enable two‑factor authentication.