CAPEC-662
Adversary in the Browser (AiTB)
An adversary exploits security vulnerabilities or inherent functionalities of a web browser, in order to manipulate traffic between two endpoints.
On this page
This attack first requires the adversary to trick the victim into installing a Trojan Horse application on their system, such as a malicious web browser plugin, which the adversary then leverages to mount the attack. The victim interacts with a web application, such as a banking website, in a normal manner and under the assumption that the connection is secure. However, the adversary can now alter and/or reroute traffic between the client application (e.g., web browser) and the coinciding endpoint, while simultaneously displaying intended transactions and data back to the user. The adversary may also be able to glean cookies, HTTP sessions, and SSL client certificates, which can be used to pivot into an authenticated intranet. Identifying AITB is often difficult because these attacks are successful even when security mechanisms such as SSL/PKI and multifactor authentication are present, since they still function as intended during the attack.
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-662: Adversary in the Browser (AiTB): how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/662.html and https://cve.bz/cve/capec/662?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Experiment
They probe what they found.
The adversary tricks the victim into installing the Trojan Horse malware onto their system.
1 technique
- Conduct phishing attacks, drive-by malware installations, or masquerade malicious browser extensions as being legitimate.
The adversary inserts themself into the communication channel initially acting as a routing proxy between the two targeted components.
Exploit
They carry out the attack.
The adversary observes, filters, or alters passed data of their choosing to gain access to sensitive information or to manipulate the actions of the two target components for their own purposes.
Prerequisites
The adversary must install or convince a user to install a Trojan.
There are two components communicating with each other.
An attacker is able to identify the nature and mechanism of communication between the two target components.
Strong mutual authentication is not used between the two target components yielding opportunity for adversarial interposition.
For browser pivoting, the SeDebugPrivilege and a high-integrity process must both exist to execute this attack.
Skills required
- Medium skill
Tricking the victim into installing the Trojan is often the most difficult aspect of this attack. Afterwards, the remainder of this attack is fairly trivial.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Modify Data | Integrity | |
| Gain Privileges | Confidentiality, Access Control, Authorization | |
| Read Data | Confidentiality |
Mitigations
Ensure software and applications are only downloaded from legitimate and reputable sources, in addition to conducting integrity checks on the downloaded component.
Leverage anti-malware tools, which can detect Trojan Horse malware.
Use strong, out-of-band mutual authentication to always fully authenticate both ends of any communications channel.
Limit user permissions to prevent browser pivoting.
Ensure browser sessions are regularly terminated and when their effective lifetime ends.
Weaknesses it exploits
Recent CVEs with these weaknesses
- 7.2CVE-2026-118791
The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification.
- 6.3CVE-2026-112170
The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates.
- 9.2CVE-2026-118462
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
- 2.0CVE-2026-123508
Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject…
- 7.5CVE-2026-104657
Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user …
- 7.4CVE-2026-116789
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, dtls_state_setup() compared a peer cert…
- 2.1CVE-2026-121750
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, `nvm_download_artifact` downloads a release archive directly to its final path in `$NVM_DIR/.cache` a…
- 8.6CVE-2026-110022
The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the …
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-94 Adversary in the Middle (AiTM)
Examples
An adversary conducts a phishing attack and tricks a victim into installing a malicious browser plugin. The a…
An adversary conducts a phishing attack and tricks a victim into installing a malicious browser plugin. The adversary then positions themself between the victim and their banking institution. The victim begins by initiating a funds transfer from their personal savings to their personal checking account. Using injected JavaScript, the adversary captures this request and modifies it to transfer an increased amount of funds to an account that they controls, before sending it to the bank. The bank processes the transfer and sends the confirmation notice back to the victim, which is instead intercepted by the adversary. The adversary modifies the confirmation to reflect the original transaction details and sends this modified message back to the victim. Upon receiving the confirmation, the victim assumes the transfer was successful and is unaware that their money has just been transferred to the adversary.
In 2020, the Agent Tesla malware was leveraged to conduct AiTB attacks against organizations within the gas, …
In 2020, the Agent Tesla malware was leveraged to conduct AiTB attacks against organizations within the gas, oil, and other energy sectors. The malware was delivered via a spearphishing campaign and has the capability to form-grab, keylog, copy clipboard data, extract credentials, and capture screenshots. [REF-630]
Boy in the browser attacks are a subset of AiTB attacks. Similar to AiTB attacks, the adversary must first tr…
Boy in the browser attacks are a subset of AiTB attacks. Similar to AiTB attacks, the adversary must first trick the victim into installing a Trojan, either via social engineering or drive-by-download attacks. The malware then modifies the victim's "hosts" file in order to reroute web traffic from an intended website to an adversary-controlled website that mimics the legitimate website. The adversary is now able to observe, intercept, and/or modify all traffic, as in a traditional Adversary in the Middle attack (CAPEC-94). BiTB attacks are low-cost, easy to execute, and more difficult to detect since the malware often removes itself once the attack has concluded. [REF-631]
Man in the Mobile attacks are a subset of AiTB attacks that target mobile device users. Like AiTB attacks, an…
Man in the Mobile attacks are a subset of AiTB attacks that target mobile device users. Like AiTB attacks, an adversary convinces a victim to install a Trojan mobile application on their mobile device, often under the guise of security. Once the victim has installed the application, the adversary can capture all SMS traffic to bypass SMS-based out-of-band authentication systems. [REF-632]
MITRE's words, unchanged: CAPEC-662 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.