😺 Cat Facts Daily

Cats sleep 70% of their lives. Enjoy this innocent page while it… does nothing suspicious at all.

— PoC controls (attacker view; would be hidden/auto in a real attack) — Victim base URL:

Attacker username:

Attacker password:

The button label is bait. Clicking it fires the forged login. In a real attack this runs automatically on page load (see the auto-submit form below), no click needed.

waiting…

Step 2 — after the forged login lands, open the victim app as a normal top-level navigation. Because the session cookie is SameSite=Lax, it rides this navigation and you will be looking at the attacker's account: