The browser, the main vector of corporate intrusions in 2026

In 2026 the browser has become the main battlefield for corporate intrusions: not only is it the gateway to business applications, but it runs a large part of the attack chain there. Reports and detections from the sector point to six techniques that dominate the landscape: phishing AiTM with proxy inverse, campaigns that induce victims to paste and execute commands (ClickFix and variants), abuse of OAuth flows and consents, malicious or compromised extensions, "ghost" passwords commitments outside of SSO, and sequestration of sessions. I then explain what is happening, how these tactics work technically, who they affect, what practical consequences they have and what concrete measures can be implemented by security teams and users.

Facts confirmed: suppliers and sector reports have documented a sustained increase in attacks that are fully developed within the browser. Microsoft and other public reports catalogue techniques such as OAuth consent supplanting and the use of Physing-as-a-Service kits; RFC 8628 technically describes the "device code flow" that is being abused on the real ground (RFC 8628). The Verizon Data Break Investigations Report (DBIR) 2025 and other analyses point out that a significant percentage of incidents start in unmanaged devices and that the theft of credentials remains present in many intrusions (Verizon DRIR). Microsoft has also highlighted recent vectors where user hits commands on your computer as initial vector engagement (Microsoft Digital Defense Report).

How they work, in technical terms: AiTM kits (adversary-in-the-middle per proxy inverse) create a gateway between victim and legitimate service and relive in real time credentials, cookies and session tokens, which allows to circumvent MFA based on user-controlled factors. ClickFix and its variants convince the victim to copy and run commands in their terminal; these scripts usually install infostealers or RATs, which exfilter cookies, credentials and session devices. OAuth's abuses take advantage of consent flows or the "device code" to obtain tokens without the user's reassurance of credentials; here the authentication mechanism remains intact, but the permit granted authorizes the attacker. The malicious extensions get sufficient browser permissions to read and modify pages, record clicks or capture tokens in transit; actors often buy legitimate extensions and corrupt them in an update. Finally, "ghost login" appears when non-integrated applications with the SSO maintain local credentials or alternative authentication methods that remain outside the control of the identity provider and its records.

Who it affects: organizations with intensive use of web apps - fintech, SaaS, health, legal -, equipment with developers using personal or third-party machines, and any company that allows extension-free installation or does not apply centralized SSO policies. Individual users are also at risk for the same dynamic: synchronized browsers with personal accounts can spread tokens and passwords to corporate environments, and the practices of copying / paste commands are common among employees who try to "fix" problems on their own.

Actual consequences: an intrusion that never leaves the browser makes it difficult to detect by traditional tools focused on mail, network or endpoint, because traffic seems legitimate and the captured credentials or tokens are valid. The result can be persistent access, silent data exfiltration, side movements using reused credentials and, in environments with activated synchronization, cross-commitments between personal and corporate accounts. In addition, the marketing of these kits reduces the technical barrier of the attacker, expanding the potential number of malicious operations directed.

Estimated and still uncertain information: the exact rates of incidence between techniques vary according to the dataset of the supplier that publishes them; for example, some commercial telemetry actors report that ClickFix has been dominant in its corpus, but the figures are not always representative of all sectors or regions. There is also uncertainty about the long-term effectiveness of specific emerging defences (e.g., certain DPoP or token binding implementations), because attackers quickly adapt their tools.

Specific and practical measures - what security teams and users must do today:

- Implement browser policies at the central level: use extension allowing and default locking policies managed via Chrome Enterprise, Edge for Business or your EMM's browser policies. Control updates and deployment code revisions for internal extensions.

- Restringe and audit third-party applications and OAuth consent: configure an approval process for any app that requests permission, limit the scopes, and register each consent. Review and revoke inactive permissions regularly and alert you about unusual consents or from new PIs.

- Prohibit or mitigate the practice of copying / paste commands: establish technical measures to block the execution of unsigned scripts (PowerShell Constrained Language, running policies, AppLocker / WDAC in Windows), display EDR with behavior control and disable direct gluing in consoles in corporate systems.

- Increase visibility over sessions and tokens: record and monitor tokens uses, detect session replays, implement detection of anomalies in the use of tokens (new geolocation, different user agent). Favore short-term sessions and automatic revocation of refresh tokens after risk changes.

- Enforce SSO and close "ghost login": centralize access via IdP, disable local authentication methods in applications whenever possible, and audit login outside the IdP. For applications that do not support SSO, document and manage credentials with corporate vaults and rotation policies.

- Treat unmanaged devices as high risk: apply conditional access policies that require devices with known postage, minimize the use of corporate accounts on personal machines and deactivate browser synchronization for sensitive accounts.

- Education and team network: form users with phishing exercises that include non-e-mail vectors (messaging, SMS, social networks) and campaigns that simulate requests to paste and run commands. Combine training with technical tests - browser isolation, remote navigation or web security proxies - to reduce the attack surface.

These action lines combine technical controls, governance and awareness-raising. No measure is complete on its own: the threat has migrated to the browser and requires specific controls at that level. To deepen the OAuth flows and the device code technique, see the standard text RFC 8628 and for context on intrusion trends and unmanaged devices review the Verizon DBIR and the digital defence reports of the large suppliers mentioned above (Verizon DRIR) (Microsoft Digital Defense Report). Implementing managed browser policies, auditioning OAuth consensus and putting technical obstacles to "paste-and-run" are the actions with the most immediate return to reduce risk.