In-session phishing is a form of potential phishing attack which relies on one web browsing session being able to detect the presence of another session (such as a visit to an online banking website) on the same web browser, and to then launch a pop-up window that pretends to have been opened from the targeted session.^[1] This pop-up window, which the user now believes to be part of the targeted session, is then used to steal user data in the same way as with other phishing attacks.^[2]

The advantage of in-session phishing to the attacker is that it does not need the targeted website to be compromised in any way, relying instead on a combination of data leakage within the web browser, the capacity of web browsers to run active content, the ability of modern web browsers to support more than one session at a time, and social engineering of the user.^[3]

The technique, which exploited a vulnerability in the JavaScript handling of major browsers, was found by Amit Klein, CTO of security vendor Trusteer, Ltd.^[4][5] Subsequent security updates to browsers may have made the technique impossible.

• Eisen, Ori (March 2009). "In-session phishing and knowing your enemy". Network Security. 2009 (3): 8–11. doi:10.1016/S1353-4858(09)70027-3.
• New Phishing Attack Targets Online Banking Sessions With Phony Popups
• New in-session phishing attack could fool experienced users