Authorities Sound the Alarm on Tabnabbing, a Deceptively Sophisticated Scam
A sophisticated new phishing technique known as “tabnabbing” is raising serious concerns among cybersecurity professionals and authorities.
This scam manipulates inactive browser tabs by covertly replacing their content with convincing fake login pages that mimic trusted platforms—such as email providers, banking services, or online retailers.
When users return to the tab, believing they are still on a legitimate site, they are prompted to enter their credentials, unknowingly handing them over to attackers.
The term “tabnabbing” is a blend of “tab” and “nabbing,” highlighting the method’s deceptive twist on traditional phishing.
🚨 #Tabnabbing : la nouvelle #arnaque sur #Internet qui piège même les plus #vigilants ! 😨🚨
Une technique de #phishing encore plus discrète et redoutable.
🛑 Comment ça fonctionne ?
1️⃣ Vous laissez un #onglet ouvert mais inactif sur votre #navigateur.
2️⃣ Des #cybercriminels… pic.twitter.com/WSot2Xi31N
— Prévention Contre Les Arnaques (@AntiArnaqueX) May 3, 2025
It relies not on obvious tricks, but on the user’s routine behaviour and trust in familiar interfaces.
After a period of inactivity, malicious scripts can quietly alter a tab’s contents and even its icon or title, making the change nearly invisible to the unsuspecting eye.
By disguising themselves as credible login portals, these scams aim to harvest sensitive data—including passwords, identity details, and financial information—while flying under the radar.
Tabnabbing Could Be the Next Big Threat in the Cyber Scam Landscape
Though tabnabbing has been on cybersecurity radars for years, recent reports suggest a resurgence in its use.
In Spain, police have even launched a social media awareness campaign to alert internet users to the rising threat.
¿Sabes lo que es el #tabnabbing? 🤔
💻Si sueles tener muchas #ventanas abiertas al mismo tiempo en tu navegador...
Podrías ser víctima de esta estafa ⬇️#Ciberseguridad #Consejos pic.twitter.com/zG2A5J06x0
— Policía Nacional (@policia) April 9, 2025
To reduce your risk, it is wise to limit the number of browser tabs you keep open—more tabs can mean more potential targets for malicious scripts.
Always double-check web addresses, especially if a login page appears unexpectedly; subtle misspellings or suspicious characters in a URL are often red flags.
As with traditional phishing, which impersonates trusted brands through deceptive emails or links, staying alert and sceptical remains your strongest line of defense.