# Injected login UI credential capture

Login UI rendered from proxied, iframe, or native-dialog content that harvests credentials or tokens

_Area: Web authentication and account takeover. Seen in 2 disclosed reports; one confirmed bounty: $5,000; latest 2024-05-23. Updated 2026-11-02._

## How it works
A login surface assumes whatever it renders is the real authentication endpoint. When the page loads remote content, an iframe, or a native credential dialog, the browser or app cannot tell a genuine login from an attacker-supplied one. The user types secrets into a UI that looks legitimate but is controlled elsewhere, so the boundary between "the app's login" and "attacker content" collapses.

## Where it shows up
- Login markup assembled at runtime with `document.write()` from base64 blocks that inject an iframe of the real portal [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-smugglers-gambit-uncovering-html-smuggling-adversary-in-the-middle-tradecraft.md)
- A login portal served from an attacker domain that transparently proxies the real one rather than cloning it [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-smugglers-gambit-uncovering-html-smuggling-adversary-in-the-middle-tradecraft.md)
- Remote resources (e.g. `<img>`) that can return `401 WWW-Authenticate` and trigger a native credential prompt [E2](https://bugbountylibrary.com/r/blog%3Ajonbottarini-com-2021-12-09-dont-reply-a-clever-phishing-method-in-apples-mail-app.md)
- Native auth dialogs whose realm/message text is attacker-controlled [E2](https://bugbountylibrary.com/r/blog%3Ajonbottarini-com-2021-12-09-dont-reply-a-clever-phishing-method-in-apples-mail-app.md)
- Lookalike download pages with credential fields that post typed server, login and password to a third-party collector [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-fake-watchguard-vpn-credential-phishing.md)
- Pages that then serve the vendor's genuine signed installer to look harmless [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-fake-watchguard-vpn-credential-phishing.md)

## How to review
Identify every place a login UI can be sourced from remote or attacker-influenced content. The invariant: credentials must only ever be entered into a UI whose origin and content the trusted party fully controls, and native auth prompts must never be triggerable by cross-origin subresources. Check whether remote image/resource loads can surface auth dialogs, whether login markup is assembled from fetched content, and whether a suspected page personalizes per-user (a live proxy) versus static (a clone). For downloads, confirm the URL resolves to the vendor's own CDN and that no credential field posts off-origin [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-fake-watchguard-vpn-credential-phishing.md).

## How finders spotted it
- Telemetry flagged same-subdomain `.pro` domains registered the day before, web root redirecting to example.com; VirusTotal relations surfaced an HTML payload contacting them; base64 `document.write()` blocks revealed an injected iframe [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-smugglers-gambit-uncovering-html-smuggling-adversary-in-the-middle-tradecraft.md)
- Injecting a test username into the `?qrc=` parameter produced a user-specific login page, proving a transparent proxy rather than a clone [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-smugglers-gambit-uncovering-html-smuggling-adversary-in-the-middle-tradecraft.md)
- Prior observation that non-image content can load inside `<img>` tags, plus a spam email that was just a large JPG evading filters, led to hypothesizing a 401 "photo" would trigger a prompt in Mail [E2](https://bugbountylibrary.com/r/blog%3Ajonbottarini-com-2021-12-09-dont-reply-a-clever-phishing-method-in-apples-mail-app.md)
- SOC triaged a Defender alert; browser history showed a search for the VPN download and a click to a lookalike domain 8 seconds later, prompting analysis of `popup.js` and the download flow [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-fake-watchguard-vpn-credential-phishing.md)

## Variants seen
- Transparent proxy of the real Outlook login capturing session tokens, bypassing MFA [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-smugglers-gambit-uncovering-html-smuggling-adversary-in-the-middle-tradecraft.md)
- Native `WWW-Authenticate` prompt rendered from a remote `<img>` in a mail client, with spoofed realm text [E2](https://bugbountylibrary.com/r/blog%3Ajonbottarini-com-2021-12-09-dont-reply-a-clever-phishing-method-in-apples-mail-app.md)
- SEO-poisoned lookalike site harvesting credentials via JS, then serving the genuine signed installer [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-fake-watchguard-vpn-credential-phishing.md)

## Why fixes fail
A prior fix for the mail-client prompt was bypassed by embedding the image inside the app's "email templates" feature, showing the prompt path survived in another render context [E2](https://bugbountylibrary.com/r/blog%3Ajonbottarini-com-2021-12-09-dont-reply-a-clever-phishing-method-in-apples-mail-app.md).

## Impact and severity
Session token theft bypassing MFA in a mass phishing campaign [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-smugglers-gambit-uncovering-html-smuggling-adversary-in-the-middle-tradecraft.md); credential phishing of Apple account users through a native-looking prompt [E2](https://bugbountylibrary.com/r/blog%3Ajonbottarini-com-2021-12-09-dont-reply-a-clever-phishing-method-in-apples-mail-app.md); theft of VPN server/login/password from admins, with the signed installer masking the attack from EDR [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-fake-watchguard-vpn-credential-phishing.md). Impact rises when token capture defeats MFA [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-smugglers-gambit-uncovering-html-smuggling-adversary-in-the-middle-tradecraft.md) and when the payload leaves no malware for defenders to flag [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-fake-watchguard-vpn-credential-phishing.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **Apple Mail** (email compose/reply rendering of remote images) macOS High Sierra 10.13 to macOS Big Sur 11.2, fixed in macOS Big Sur 11.2: Don’t Reply: A Clever Phishing Method In Apple’s Mail App. Report: https://bugbountylibrary.com/r/blog%3Ajonbottarini-com-2021-12-09-dont-reply-a-clever-phishing-method-in-apples-mail-app.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-smugglers-gambit-uncovering-html-smuggling-adversary-in-the-middle-tradecraft.md
- E2: https://bugbountylibrary.com/r/blog%3Ajonbottarini-com-2021-12-09-dont-reply-a-clever-phishing-method-in-apples-mail-app.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-fake-watchguard-vpn-credential-phishing.md