Fake login pages in the browser

How it usually happens in the browser

• A message, search result, QR code, or ad sends the user to a lookalike domain.
• The page copies the real service's logo, layout, and sign-in prompts.
• The form sends the password and any manually entered code to the attacker.
• Some kits relay the real login and capture the resulting session.
• The page may then redirect to the legitimate service to reduce suspicion.

What traditional defenses miss

• A newly created or compromised site may not appear on a blocklist yet.
• HTTPS encrypts the connection. It does not confirm who owns the page.
• A manually entered one-time code can be relayed to the real service.
• Small mobile address bars make hostname checks harder.

How isolation changes the game

• An isolated session keeps the page's active code away from the local browser and device.
• Closing the session removes its site storage and contained downloads.
• Isolation does not prove that a page is legitimate. Never enter credentials into an unverified page.

Operational checklist

• Open the service from a saved bookmark or a known address instead of the message link.
• Check the full hostname before entering any account information.
• Use a password manager. Treat a missing saved login as a warning to verify the site.
• Report the message and page through your normal security channel.
• Prefer phishing-resistant authentication such as WebAuthn for high-impact accounts.
• Route untrusted pages into isolation and restrict downloads from those sessions.

FAQs.