Nick Perry warns of a phishing attack called browser-in-the-browser that creates a fake Google sign-in popup indistinguishable from the real thing. The fake window, built with HTML and CSS, captures your password and session token, bypassing two-factor authentication. If you can't drag the popup outside your browser window, it's a scam.
Never ever ever log in to any account ever again until you know this one thing. Because hackers just found a way to access your accounts, even with two-factor authentication turned on. Here's how it works. When you click "Sign in with Google" on a phishing site, this appears. It looks exactly like how Google would show it. It has all the right buttons, icons, and even resizes perfectly for your device. But here's the thing. It's not a real window. It's just code—HTML and CSS—drawn to look like a real window. This hacking technique is called "browser in the browser," and hackers do it with an app called Sneaky2FA. So now when you enter your password, they steal it and your session token, which means having two-factor authentication enabled doesn't save you. So before you enter your password on any popup window, try to drag it off your browser. If you can't, it's a scam.
