Sign in

to continue to Canva

Welcome

U

You just got phished!

Email captured:

Password captured:

This is NOT a real Google window. It's a fake browser rendered inside the webpage using HTML & CSS. This technique is called a Browser-in-the-Browser (BitB) attack.

How to spot this attack:

Drag test: Try dragging this "window" outside your browser. You can't — it's a div.
Resize test: Resize your browser. A real popup stays independent.
Tab test: Real OAuth opens a separate OS window, not a layer on the page.
URL test: Click the address bar. It's not editable — because it's fake.

Be careful next time. Stay safe online.

What will you design today?