What Is Pop-Up Phishing?

What Is Pop-Up Phishing?

Pop-up phishing is a social engineering attack in which a fraudulent browser pop-up, overlay, or notification impersonates a trusted brand, operating system, or login service to extract credentials, payment, remote access, or command execution from the viewer.

Email phishing delivers its lure to an inbox; pop-up phishing delivers it inside the browser, on a page reached through a search ad, a compromised website, or a notification permission granted weeks earlier.

How pop-up phishing works

The attack runs in three stages: get the victim onto attacker-controlled content, render a fake interface, then convert the response into something usable.

Delivery rarely depends on a mistyped URL. Attackers buy search ads (opens in new tab) against high-intent queries such as "aws," inject JavaScript into compromised WordPress sites that forces a fullscreen iframe (opens in new tab) over the real page, or abuse a push-notification permission (opens in new tab) granted weeks earlier to push fake antivirus warnings long after the tab closes; on macOS these can appear to originate (opens in new tab) from the system itself.

Rendering carries the deception: the "pop-up" is usually an HTML element positioned with CSS, or a script pushing the page full-screen with alert loops and history.pushState abuse.

In the browser-in-the-browser (BitB) technique mr.d0x published (opens in new tab) in March 2022, the page draws a fake browser window complete with title bar, controls, padlock, and an address bar reading accounts.google.com, then loads a credential form from attacker infrastructure into an <iframe> inside that fake frame.

Conversion cashes in the response: an employee searches for a SaaS login, clicks a sponsored result, and lands on what looks like a Microsoft single sign-on window. The URL and padlock read correctly, and the form accepts the password and MFA code. Behind it, a reverse proxy relays everything to the real service and captures the session cookie.

One tell: the fake window usually can't be dragged (opens in new tab) outside the real browser frame, and a password manager typically won't autofill inside it.

Why pop-up phishing is hard to stop

The browser's own pop-up blocker misses most of it. A click or keypress can spawn pop-ups (opens in new tab) regardless of blocker settings, and the overlays used in BitB, ClickFix, and fullscreen iframe injection are ordinary page elements blockers generally don't treat as pop-ups. Checking the address bar, the usual reflex, fails against BitB for the same reason: the page has drawn the bar the victim checks.

The same techniques also hide the lure from investigators. Cloaking platforms serve clean content to ad reviewers and scanners, and datacenter IP blocking (opens in new tab) means an analyst on the corporate network sees a harmless page while an employee at home sees a perfect Microsoft 365 clone.

Attackers also host browser-locker payloads on Azure Blob Storage (opens in new tab) and other free cloud services, keeping blocklists a step behind.

Generative AI has removed the craft barrier on top of that. By February 2026, attackers used large language models for the rapid generation (opens in new tab) of phishing lures, and by September 2026 a threat actor was building fake Windows credential dialogs (opens in new tab) and a ClickFix-style Win+R lure with commercial AI tooling.

Brand-accurate pop-ups are the baseline now, and in adversary-in-the-middle form they capture the session cookie ordinary MFA was supposed to protect.

Types of pop-up phishing

Five recognizable forms differ in what they imitate and extract, and in how they convert the response.

1. Browser-in-the-browser credential windows. A fake SSO window rendered inside the page performs credential harvesting through a spoofed address bar. The Sneaky2FA phishing-as-a-service kit added BitB (opens in new tab) to load its reverse-proxy Microsoft page inside the fake pop-up.
2. ClickFix and fake CAPTCHA pop-ups. A cloned Cloudflare "Verify you are human" screen tells the user to fix the error by pasting a pre-staged clipboard command (opens in new tab) into the Run dialog. Between July 2024 and June 2025, ClickFix accounted for 47% of initial access methods (opens in new tab), surpassing traditional phishing's 35%. It has carried the MITRE ATT&CK identifier T1204.004 since March 2025, and the family now includes FileFix and TerminalFix.
3. Tech-support scareware and browser lockers. A full-screen fake virus alert displays a phone number for "Microsoft Support," and the payoff is remote access via TeamViewer, AnyDesk, or UltraViewer. In an August 2025 tag team pattern (opens in new tab), the Microsoft-impersonating pop-up hands the caller to someone posing as the FTC.
4. Adversary-in-the-middle re-authentication prompts. A reverse proxy such as Evilginx, EvilProxy, or Tycoon 2FA presents a login page carrying the organization's own Entra ID branding, relays the session live, and captures the authenticated cookie. A global coalition disrupted Tycoon 2FA (opens in new tab) in March 2026, after it abused Cloudflare Workers (opens in new tab) to proxy Microsoft, GoDaddy, and Okta logins.
5. Fake browser update prompts. Injected JavaScript on compromised sites shows an update prompt matching the visitor's browser and version.

TA569 operates SocGholish as malware-as-a-service, selling access to the machines it infects.

How to defend against pop-up phishing

Phishing-resistant MFA removes the credential payoff from login-page variants, BitB windows, and AitM re-authentication prompts; ClickFix and fake-update lures need endpoint controls instead.

FIDO2 passkeys bind each credential to a Relying Party ID and verify the origin (opens in new tab) before signing, so FIDO produces no signature for a BitB window served from the attacker's own domain.

1. Browser policy. Block notifications and pop-ups by default, raise Safe Browsing and SmartScreen enforcement, and turn on Edge's scareware blocker (opens in new tab).
2. Endpoint controls. ClickFix bypasses identity controls by harvesting command execution, so alert on Run-dialog and Terminal launches that spawn PowerShell, and restrict unsanctioned remote access tools. Watch for the telltale sequence (opens in new tab) of inbox flood, Quick Assist, then PowerShell or MSHTA execution.
3. Protective DNS. A protective DNS (opens in new tab) resolver blocks known-malicious redirect and hosting domains upstream of the browser.
4. Training that names the tells. Treat any unsolicited pop-up that asks you to call a phone number (opens in new tab) as a scam indicator, and a password manager that won't autofill as a second, reliable one. Employees report faster when they know the organization won't reprimand them, which is why no-blame reporting (opens in new tab) belongs in the policy.
5. Brand-side monitoring and takedown. Malicious ads have shown the real brand URL (opens in new tab) as the visible link while routing to a fake support page, so monitor ad networks for your brand name and escalate abuse through host and registrar to ICANN Compliance (opens in new tab).

How Doppel helps

Doppel is the Frontier AI Social Engineering Defense (SED) platform unifying Digital Risk Protection and Human Risk Management to detect and dismantle social engineering threats. Brand Protection detects impersonation campaigns involving paid ads and phishing pages across search, social, app stores, and messaging, and flags lookalike domains.

When a cloaked ad surfaces, the Doppel Threat Graph maps it to the redirect domain, the hosting account behind the browser locker, and the number on the fake support page, and agentic AI executes takedowns across the registrar, host, and ad network while analysts handle complex escalations.

Simulation converts a detected pop-up campaign into an employee exercise in one click, replaying the same fake CAPTCHA or SSO window in a multi-channel exercise across email, SMS, voice, and Teams. Doppel's median takedown time is under 10 hours (opens in new tab), and together these workflows dismantle the redirect domains, hosting accounts, support numbers, and ads that keep a campaign running.

Request a demo to see takedowns running against live impersonation infrastructure targeting your brand

Frequently asked questions about pop-up phishing

What is pop-up phishing?

Pop-up phishing uses a fake browser pop-up, overlay, or notification to impersonate a trusted company or login page and trick the viewer into handing over credentials, payment, remote access, or command execution. Because it's usually HTML drawn inside the page, it turns up on compromised sites, pages reached through malicious search ads, and sites that got notification permission earlier, as fake virus warnings, fake SSO windows, or fake CAPTCHA screens that ask for a pasted command.

What is pop-up phishing in cybersecurity?

Pop-up phishing is a delivery variant of phishing: the lure arrives through the browser instead of an inbox or text message, but the goal is the same. Security teams track its forms separately, from tech-support scareware and browser-in-the-browser windows to ClickFix's clipboard-loaded commands (MITRE ATT&CK T1204.004), all of which bypass email filtering; the adversary-in-the-middle form also captures the session cookie that non-phishing-resistant MFA is supposed to protect.

Pop-up phishing vs. scareware: what is the difference?

Scareware fabricates a security emergency, such as a virus infection, to frighten the viewer into paying for fake software or calling a fake number. Pop-up phishing is the broader category: any pop-up that impersonates a trusted party to get credentials, payment, access, or command execution. Scareware is its fear-driven lure type; other forms run on trust instead, like a fake Microsoft 365 sign-in window that captures a password or pasted command directly in the browser.

What is an example of pop-up phishing?

TerminalFix (opens in new tab) provides a current example from August 2026. A fake Cloudflare CAPTCHA overlay directed victims to paste a command into Windows Terminal or PowerShell, which downloaded a ZIP archive pairing a legitimate binary with a rogue DLL to sideload a backdoor. The payload established persistence and opened a reverse-tunnel connection into the victim's network.