Which attack is browser-based and uses a malicious extension or code to manipulate security checks?

Which attack is browser-based and uses a malicious extension or code to manipulate security checks?

• A. Trojans
• B. Man-in-the-Browser Attack
• C. CSRF Attack
• D. Session Hijacking

Answer: (B)

The attack hinges on code or an extension that runs inside the browser and intercepts or alters what the user sees and submits, effectively manipulating security checks from within the browser itself. This malicious browser component sits between the web page and the user, so it can modify form fields, inject fake prompts, or change transaction details in real time. Because the manipulation happens inside the browser, security checks that rely on the browser’s execution can be bypassed or altered, making the user think they’re interacting with a legitimate site while the attacker changes the outcome. This is different from broader malware like Trojans, which aren’t necessarily tied to the browser; CSRF relies on forged requests from a user’s session without malware running inside the browser; standard Man-in-the-Middle attacks intercept traffic on the network, not inside the browser; and session hijacking focuses on stealing and using someone’s session token rather than altering browser behavior to subvert security checks.

The attack hinges on code or an extension that runs inside the browser and intercepts or alters what the user sees and submits, effectively manipulating security checks from within the browser itself. This malicious browser component sits between the web page and the user, so it can modify form fields, inject fake prompts, or change transaction details in real time. Because the manipulation happens inside the browser, security checks that rely on the browser’s execution can be bypassed or altered, making the user think they’re interacting with a legitimate site while the attacker changes the outcome.

This is different from broader malware like Trojans, which aren’t necessarily tied to the browser; CSRF relies on forged requests from a user’s session without malware running inside the browser; standard Man-in-the-Middle attacks intercept traffic on the network, not inside the browser; and session hijacking focuses on stealing and using someone’s session token rather than altering browser behavior to subvert security checks.