<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Browser-in-the-Middle | He (Shawn) Shuang's Personal Site</title><link>https://8759s.github.io/tags/browser-in-the-middle/</link><atom:link href="https://8759s.github.io/tags/browser-in-the-middle/index.xml" rel="self" type="application/rss+xml"/><description>Browser-in-the-Middle</description><generator>Hugo Blox Builder (https://hugoblox.com)</generator><language>en-us</language><lastBuildDate>Tue, 23 Sep 2025 00:00:00 +0000</lastBuildDate><image><url>https://8759s.github.io/media/icon_hu_1035bcf07d2ae8d9.png</url><title>Browser-in-the-Middle</title><link>https://8759s.github.io/tags/browser-in-the-middle/</link></image><item><title>IOCs for phishing campaign using BitM pages</title><link>https://8759s.github.io/news/iocs-for-phishing-campaign-using-bitm-pages/</link><pubDate>Tue, 23 Sep 2025 00:00:00 +0000</pubDate><guid>https://8759s.github.io/news/iocs-for-phishing-campaign-using-bitm-pages/</guid><description>&lt;p>This active browser-in-the-middle (BitM) phishing campaign impersonates Meta and Facebook. It has been observed using copyright-infringement notices as email lures, followed by redirect chains that lead targets to BitM pages.&lt;/p>
&lt;p>Activity dates back to at least April 2025, with new domains and URLs continuing to appear. Some variants shorten the chain by linking directly to the phishing page.&lt;/p>
&lt;p>
&lt;/p></description></item></channel></rss>