What is Tab nabbing?

Tab nabbing is technique that is often used by attacker for phishing attacks. The attacker takes advantage of a user’s trust and inattention while opening multiple tabs in a browser and can deceive the victim in submitting sensitive credentials or other sensitive data.

How does tab nabbing works ?

A user open a malicious website along with multiple other tabs in the browser.

The malicious website uses some malicious script to detect when the tab is idle and inactive. this usually happens when the user is inattentive and the webpage is left unattended for some time.

once the above condition is met, the malicious script executes itself and rewrite the whole webpage in the tab where the malicious webpage was opened.

Examples of Tab nabbing

You’re most likely to fall victim to tab nabbing when you have multiple tabs open. This is standard practice for a lot of people — particularly at work, where you are often multitasking throughout the day.

When several tabs are open, it’s easy for pop-ups to appear without you noticing. You’ll probably assume that you opened the site yourself and forgot about it.

Even if you weren’t intending to visit the site, simply seeing the tab open is enough of an incentive to log in.

Alternatively, you might mistake the malicious site for a page you already have open. For example, you may have logged in to Facebook earlier, and when you see a Facebook login page, you might assume that you’d been automatically logged out.

Many sites do this as a security measure, and you’re probably used to providing your credentials at regular intervals throughout the day.

How tabnabbers will take your data

So basically tabnabbing is the process of opening so many tabs that you lose count, either to save some articles to read later or doing some researches…etc this makes it so hackers hijack inactive tabs on your browser, and showing you a fake login page. It could be for an e-mail site, a social media site, a shopping site, or even your bank and since you have so many tabs opened the probability of seeing it change/refresh is so low so if you log in after the process has been made in the background , they can take your information and use it on the legit sites.