Using the HTML5 Fullscreen API for Phishing Attacks

[Terrence Dorsey]

Feross.org[^]:

When you click on the link, you don’t actually navigate to https://www.bankofamerica.com. Instead, your browser automatically enters fullscreen mode and I load a fake version of Bank of America’s website (my demo uses a screenshot, but attackers would use a working website). The fake Bank of America site is adorned with OS and browser UI that indicates you are actually on https://www.bankofamerica.com. Of course, these UI components are just screenshots too! However, they’re pretty convincing because they actually take into account the OS and browser you are using!

Do not attempt to adjust the picture. We are controlling transmission...

[Brisingr Aerowing]

:eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek::eek:

[Julien Villers]

Nah, your phishing attempt failed, you didn't wholly fill my screen, and I could see through your smileys! ;p

'I'm French! Why do you think I've got this outrrrrageous accent?' Monty Python and the Holy Grail