Browser-based identity attacks are reshaping enterprise IAM

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Push Security's blog post: Browser-based identity attacks, ClickFix, malicious extensions, and help desk scams are reshaping enterprise account takeover risk.

Why it matters: It matters because IAM teams now have to govern the browser as an identity attack surface, not just passwords, MFA, and endpoint controls.

By the numbers:

• Identity-based attacks surged by 32% over the last year, according to Push Security.
• 97% of identity attacks were password-based, driven by a combination of credential leaks and infostealer malware, according to Push Security.
• ClickFix was the most common initial point of access for adversaries in the past year, accounting for 47% of observed attacks, according to Push Security.

Context

Browser-based identity attacks are attacks that use the web browser itself as the delivery and execution layer for phishing, credential theft, session capture, and help desk manipulation. Push Security argues that 2025 marked the point where these techniques moved from edge cases into the mainstream of enterprise compromise.

That shift matters for IAM because the browser now sits between users, federated login flows, MFA prompts, password reuse, OAuth consent, and local account exceptions. When attackers can operate inside trusted web apps and legitimate service domains, the control problem changes from perimeter blocking to identity-context validation and browser-side detection.

The article also ties the trend to wider operational and financial impact, including incidents where stolen credentials, ghost logins, and social engineering produced major disruption. For identity teams, the practical question is no longer whether these attacks are real, but whether current governance models still assume the wrong place of control.

Key questions

Q: What breaks when identity controls stop at the endpoint and ignore the browser session?

A: Browser-native attacks can complete authentication, steal tokens, and trigger consent without host-level malware or suspicious process activity. That means the organisation may see a clean endpoint while the attacker already holds a valid session. The control failure is not endpoint weakness alone, but a missing governance boundary around where identity actions actually occur.

Q: Why do browser-based phishing attacks increase account takeover risk so quickly?

A: They compress the gap between lure, credential capture, and session abuse. A user can enter a password, approve a malicious consent flow, or execute a ClickFix payload in one browser session, giving attackers the same access path the legitimate user uses. That makes response speed and session visibility critical.

Q: How do organisations reduce the blast radius of stolen non-human credentials?

A: Organisations reduce blast radius by shortening credential lifetime, limiting assigned permissions, and correlating each access event to a specific workload or agent context. That makes reuse harder, narrows lateral movement, and improves the chance of spotting a credential being used outside its intended role.

Q: How should teams verify users in help desk workflows without creating new bypasses?

A: Use a verification step that is difficult for attackers to satisfy through social engineering alone and require it before resets or recovery actions. Help desk staff should not rely on call familiarity or partial profile data. The goal is to protect the account state change, not just the conversation.

Technical breakdown

How browser-native phishing evades identity controls

Browser-native phishing works because it borrows legitimacy from real services and real login flows. Attackers use malvertising, SEO poisoning, legitimate OIDC sign-in pages, cross-domain iframes, single-use links, and page-level obfuscation to make malicious content look and behave like normal web activity. That undermines controls that rely on domain reputation, user suspicion, or mailbox filtering alone. Once the browser becomes the trusted execution context, the attacker can collect credentials, tokens, or session material without needing to compromise the endpoint first. The result is a phishing model that targets identity workflow integrity rather than only endpoint malware. Practical implication: inspect browser-side signals and login context, not just email and endpoint telemetry.

Practical implication: Inspect browser-side signals and login context, not just email and endpoint telemetry.

Why ClickFix changes the initial-access model

ClickFix-style attacks turn the user into part of the execution chain. The lure presents a fake troubleshooting or CAPTCHA step, then induces the user to paste or run malicious content locally, often leading to infostealer deployment or remote access tooling. That matters because the attack often lands before conventional detections have a clean artefact to work from, and sometimes before EDR can meaningfully intervene. From an identity perspective, the real objective is not the script itself but the session cookie or credential state that follows. Practical implication: treat clipboard-mediated execution and fake verification flows as identity-compromise precursors, not just malware events.

Practical implication: Treat clipboard-mediated execution and fake verification flows as identity-compromise precursors, not just malware events.

Why ghost logins and shared passwords create hidden blast radius

Ghost logins happen when users authenticate with local passwords on apps that should be federated through SAML or OIDC, leaving unmanaged paths that bypass central policy. When those local accounts lack MFA or reuse passwords across apps, stolen credentials can move from one service to many. Push Security’s discussion of blast radius is important because the same reused password often links several business applications, so a single compromise can expose multiple systems even when the primary identity provider remains intact. This is a governance problem, not just a login problem. Practical implication: inventory where federation is missing and where password reuse expands account takeover scope.

Practical implication: Inventory where federation is missing and where password reuse expands account takeover scope.

Threat narrative

Attacker objective: The attacker wants durable access to business applications through stolen credentials, session cookies, or abused identity workflows that bypass normal control points.

1. Entry often begins through browser-delivered lures such as malvertising, SEO poisoning, or trusted-service phishing pages that capture the user before traditional filters or endpoint controls intervene.
2. Credential_harvested follows when the victim enters passwords, consents to a malicious OAuth app, or runs ClickFix-style clipboard content that enables token or session theft.
3. Escalation occurs when stolen credentials, session cookies, or local-account logins are reused against business applications or identity-linked systems with weak MFA coverage.
4. Impact is account takeover, data theft, ransomware staging, or broader business disruption once attackers use legitimate identity paths to expand access.

Breaches seen in the wild

• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.
• 17,000+ Secrets Exposed in Public GitLab Repositories: Over 17,000 secrets including API keys and tokens exposed in public GitLab Cloud repositories.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

The browser is now an identity control plane, not just an endpoint surface. Push Security’s analysis shows that attackers increasingly exploit trusted web contexts, federated login flows, and browser-side interactions to defeat controls that were designed around email or network perimeter assumptions. That changes the governance boundary for IAM teams, because identity assurance now depends on what happens inside the browser session as much as what happens at the directory. The practical conclusion is that browser telemetry belongs in identity security architecture, not as an optional add-on.

Browser-based phishing exposes a context problem that conventional IAM still underestimates. MFA, SSO, and password policy remain necessary, but they do not solve attacks that operate inside legitimate apps, real domains, or user-approved browser interactions. The security failure is not simply weak authentication. It is the inability of standard IAM controls to distinguish a genuine user action from a fraudulent one when both occur in the same trusted interface. Practitioners should treat this as an identity context integrity issue.

Ghost login governance: Local accounts and unmanaged sign-in paths create identity exceptions that outlive the federation model they sit beside. That assumption was designed for environments where the authoritative login path is known and enforced. It fails when users can still authenticate through a password route that bypasses SSO, MFA, and policy visibility. The implication is that identity programmes must govern exception paths as first-class access routes, not as legacy leftovers.

Help desk workflows have become part of the identity attack surface. The article’s discussion of MFA bypass and credential reset scams shows that identity assurance can fail after initial authentication, at the support layer, where staff are asked to validate users and change access state. This is not a narrow social engineering issue. It is a lifecycle governance failure in which sensitive changes are triggered by weak verification. Teams should treat help desk identity proofing as a privileged control point.

Browser-native attacks are forcing identity teams to move from prevention-only to detection-and-response thinking. Once attackers can steal credentials, cookies, or OAuth grants inside normal browser workflows, the key question becomes how quickly security teams can see what happened, scope the blast radius, and stop reuse across apps. That makes browser-side incident visibility, shared-password discovery, and session-aware response part of modern IAM operations.

What this signals

Browser-based identity attacks are collapsing the gap between user action and credential abuse. The key governance problem is that trusted web sessions can now carry the same risk as malicious infrastructure, which means IAM programmes need visibility where the user actually works. Browser telemetry, session state, and identity context should be treated as core control inputs, not auxiliary data.

Ghost login paths are the hidden exception that weakens federated identity programmes. When local accounts, unmanaged apps, or password reuse remain available, attackers do not need to defeat the primary identity provider to reach critical systems. That makes identity exception management a governance priority, not just a clean-up task.

Help desk verification is becoming a privileged identity control. If support staff can reset credentials or bypass MFA after weak verification, then the help desk is part of the attack chain. Organisations should reclassify those workflows as sensitive access changes and design them with the same scrutiny applied to privileged administration.

For practitioners

• Strengthen browser-side identity telemetry Collect signals from browser sessions, not just IdP logs, so you can see phishing lures, credential entry, clipboard events, and OAuth consent abuse as they happen.
• Eliminate ghost login pathways Find business apps that still accept local passwords or unmanaged authentication paths and convert them to federated sign-in wherever possible.
• Map password reuse blast radius Identify applications that share the same password set and revoke or reset credentials where one compromised account could unlock several systems.
• Harden help desk identity verification Require a stronger verification step before credential resets, MFA changes, or account recovery actions that can be triggered through support channels.
• Block risky browser extensions and copy-paste attack paths Review installed extensions, sideloaded add-ons, and clipboard-mediated execution patterns that attackers use to reach identity workflows.

Key takeaways

• Browser-based identity attacks are no longer edge cases, and they work because they exploit trusted user workflows rather than obvious malware paths.
• The article links this shift to large-scale identity abuse, including widespread password-based attacks, ClickFix activity, and real incidents where help desk scams or ghost logins enabled compromise.
• IAM teams need to treat browser telemetry, exception-path governance, and support-channel verification as part of the identity control plane, not separate security concerns.

Key terms

• Browser-native identity attack: An attack that succeeds inside the browser session rather than by compromising the operating system. The user may see a normal login page or application flow while the attacker steals credentials, relays authentication, or captures a valid session token without triggering endpoint-based detection.
• Ghost Login: A ghost login is a direct authentication path that remains active after an organisation believes it has moved to central single sign-on. It creates a parallel trust model that can still accept passwords, so the identity team sees one policy posture while attackers exploit another.
• ClickFix: A browser-delivered social engineering technique that persuades a user to paste and execute a malicious command, usually through clipboard manipulation and a fake instruction sequence. The key risk is that the endpoint may see a normal user action even though the payload originated from a hostile webpage.
• Identity-context enforcement: A control model that evaluates the identity behind a request before allowing sensitive data movement. Instead of relying on file patterns alone, it combines who is acting, what system is involved, and what data is being touched to make a stronger policy decision.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.