BitB, short for Browser in the Browser, is a phishing technique rather than a malware family. In the documented campaign, attackers copied content from a real Facebook page and created a polished phishing site impersonating a Liberty in North Korea grant program for North Korean defectors. The site presented a familiar-looking single sign-on experience to deceive specialists working on North Korean issues and steal personal information. Infrastructure tracing connected the operation to APT37, a North Korea-linked threat group, and researchers assessed the activity as cyberespionage intended to monitor targets’ daily lives and collect personal data.