Know Your Enemy: Browser-Based Attack Techniques in 2026
Summary: Push Security's 2026 browser attack guide names six techniques it says play out inside the browser, including reverse-proxy adversary-in-the-middle phishing kits such as Tycoon2FA, Sneaky2FA and Evilginx that relay credentials and session tokens in real time to bypass most MFA. It cites Microsoft's Digital Defense Report identifying ClickFix as the most common initial access vector at 47% of observed attacks, and Push data showing ClickFix reached 52% of its detections in Q2 2026, with four in five intercepted payloads reached from search engines rather than email.
What you should know: Push reports that of its last million observed logins, 1 in 4 were password logins rather than SSO, 2 in 5 were not protected by MFA, and 1 in 5 used a weak, breached or reused password - and Cloudflare's 2026 Threat Report found 63% of all human logins involve credentials already compromised elsewhere.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026