Browser privacy meets threat delivery

What websites see—and how attackers use it.

From ordinary browser telemetry to phishing-kit filtering, ClickFix social engineering and information-stealer delivery: where visibility ends and compromise begins.

Your current exposure

Start with the signals a page can actually read.

This diagnostic requests no exact GPS, camera, microphone or contact permission.

What this page can read

Your browser shares technical signals

Public connection
Checking…
Approximate location
Approximate location unavailable
Network operator / ISP
Checking…
ASN
Checking…
Browser
Unknown browser
Operating system
Detecting…
Screen
Detecting…
Time zone
Detecting…
Language
Detecting…
Privacy preferences
GPC: Detecting… · DNT: Detecting…

This check does not request exact GPS, camera, microphone or contact access.

The essential distinction

The same signals, used with a different intent.

Websites receive your public network address because they need somewhere to return the response. They use browser and device information to choose compatible layouts, languages, media formats and authentication flows. None of that is inherently malicious.

The privacy and security risk comes from combination and purpose. A phishing kit or traffic distribution system can combine network, browser and interaction signals to identify a desirable target, exclude an analyst or automated scanner, and show different content to different visitors. This is commonly called filtering or cloaking.

Visible signalOrdinary purposePossible malicious use
IP, country and ASNRouting, localization and fraud controlGeofencing, campaign targeting and excluding datacenter or security-company networks
Browser and operating systemCompatibility and supportSelecting Windows, macOS or mobile-specific lures and compatible payload paths
Language and time zoneLocal content and date formattingMaking the lure look native to the visitor's region and working hours
Screen and touch supportResponsive designSeparating desktop targets from phones or automated browsing environments
Referrer and session markersNavigation and campaign measurementValidating the expected lure path, tracking a campaign and suppressing repeat delivery
Automation indicatorsAbuse and bot preventionHiding malicious content from crawlers, sandboxes and security tooling

From visit to execution

How profiling can become a malware-delivery decision.

The profiling stage usually belongs to the website injection, phishing kit or traffic distribution layer—not to the information stealer itself. A simplified defensive model looks like this:

Visitor arrivesA link or compromised site opens

The request includes network and browser information.

Signals are evaluatedThe visitor is classified

Region, ASN, device, language and automation clues may be combined.

Content is selectedDecoy or tailored lure

Researchers may see harmless content while matching targets see an overlay.

User is persuadedA fake “fix” crosses the boundary

The page asks the person to run something outside the browser.

Payload executesLoader, RAT or stealer runs

Only now can malware inspect protected host and browser data.

Relevant use case

ClickFix: when the visitor completes the infection chain.

ClickFix pages imitate a CAPTCHA, document error, registration problem or browser-update failure. The apparent solution asks the visitor to open the Windows Run dialog, PowerShell or a terminal and execute content supplied by the page. The browser has not silently installed malware; social engineering convinces the person to cross the browser's security boundary manually.

Proofpoint documented campaigns where browser-side JavaScript placed malicious content on the clipboard and the victim was guided through running it. Observed chains delivered loaders, remote-access tooling and information stealers. Other reporting describes compromised sites using filtering before presenting fake CAPTCHA overlays only to selected visitors.

Defensive references: Proofpoint — Clipboard to Compromise ↗ · Proofpoint — TA585 filtering and ClickFix ↗

Before and after compromise

An infostealer sees far more than a webpage.

It is technically important not to merge pre-delivery profiling with post-execution collection. Before execution, a webpage is constrained by the browser sandbox, permission model and same-origin rules. After an infostealer runs as a local process, it may target browser profiles, stored credentials, cookies, session material, cryptocurrency wallets and files according to its capabilities and privileges.

Before malware execution

Browser-visible profile

  • Public IP and approximate network location
  • Browser, operating system and device class
  • Screen, language, time zone and capabilities
  • Site-specific cookies and submitted form data

After malware execution

Host-level theft may begin

  • Stored credentials and browser history
  • Authentication cookies and session tokens
  • Wallet data, application secrets and selected files
  • System inventory and security-product discovery

CISA lists login credentials, browser history and cookies among data stolen by Vidar Stealer in its joint cybersecurity advisory ↗. Google Threat Intelligence has also documented compromised-site delivery chains distributing multiple infostealer families through resilient web-injection infrastructure ↗.

Practical defense

Break the chain at the human and technical boundaries.

For everyone

  • Update browsers through their built-in update screen or the operating system—not an unfamiliar webpage.
  • Treat instructions to open Run, PowerShell, Command Prompt or Terminal as a security warning.
  • Assume clipboard content supplied by a page is untrusted, even when the visible text looks harmless.
  • Use a password manager: a domain mismatch becomes easier to notice and passwords are not reused.
  • Remember that a VPN changes network identity but does not erase the rest of the browser profile.

For defenders

  • Correlate suspicious web navigation with shell, script-host or living-off-the-land execution by the same user and device.
  • Do not require a browser-child relationship: Run-dialog execution can break the obvious process ancestry.
  • Inspect command lines, downloaded content, follow-on network traffic and persistence activity as one timeline.
  • Use application control and role-appropriate restrictions for scripting engines and unsigned code.
  • Train users on the behavior pattern—the fake solution—not only the appearance of one CAPTCHA template.

Method and limitations

What this checker demonstrates—and what it does not.

The live checker demonstrates common connection and browser signals available during an ordinary visit. Browser, screen, language, time-zone and privacy-preference values are calculated in the page. Network information requires a request because every server necessarily receives the address used to connect to it.

The checker does not request exact GPS, camera, microphone or contacts. It also does not currently run canvas, audio, font, WebRTC or DNS-leak fingerprint tests. That matters: the page should not claim to measure signals it does not collect, and the absence of a result here does not prove that another site cannot use a different test.

Clear answers

Frequently asked questions

Can a website steal my passwords just because I opened it?

Normally, no. A page can read standard browser and connection signals, but passwords, session tokens and files are protected by browser and operating-system boundaries. Theft usually requires credential entry, a granted permission, a vulnerability or execution of malicious code.

Is ClickFix a browser exploit?

Usually not. ClickFix is social engineering that persuades a person to open Run, PowerShell or Terminal and execute content supplied by the page. The user is manipulated into crossing the security boundary manually.

Does a VPN stop browser profiling?

A VPN changes the public IP and apparent network location seen by the destination, but it does not automatically hide browser, screen, language, time-zone, account or device signals.

Is private browsing enough to prevent fingerprinting?

No. Private browsing mainly limits local history and cookie persistence after the session. Websites still receive network information and many standard browser signals during the visit.