# Phishing and browser threats

> How phishing, QR code scams, session hijacking, credential stuffing, formjacking and other browser attacks work, and how to spot and stop each one.

Canonical: https://www.phishclean.com/threats
Last updated: 2026-11-06

Most attacks in a browser want one of three things: your password, your login session or your card number. These guides explain how each attack works, how to spot it and what stops it.

## Attacks on your logins

- [Phishing attacks](https://www.phishclean.com/threats/phishing-attacks): Fake pages and messages that get you to hand over a password. How they work, with real examples.
- [QR code phishing](https://www.phishclean.com/threats/qr-code-phishing-attacks): Malicious links hidden behind a code you scan, which can slip past email filters.
- [Session hijacking](https://www.phishclean.com/threats/session-hijacking-attacks): Stealing the login cookie your browser keeps, which can get around your password and 2FA.
- [Credential stuffing](https://www.phishclean.com/threats/credential-stuffing-attacks): Automated logins that try passwords leaked in one breach on your other accounts.

## Attacks hidden inside a page

- [Formjacking](https://www.phishclean.com/threats/formjacking-attacks): Malicious JavaScript on a real checkout page that copies card numbers as you type.
- [Hidden iframes](https://www.phishclean.com/threats/hidden-iframe-attacks): Invisible frames behind clickjacking, credential harvesting, crypto mining and ad fraud.
- [SSL stripping](https://www.phishclean.com/threats/ssl-stripping-attacks): A man-in-the-middle attack that removes HTTPS without you noticing, and why HSTS is not a complete fix.

## Scams that use fear

- [Tech support scam popups](https://www.phishclean.com/threats/tech-support-scam-popups): Fake virus warnings that push you to call a scam number, and how to get out of one.

## If something already happened

- [I clicked a phishing link](https://www.phishclean.com/help/clicked-a-phishing-link): an interactive recovery checklist, with where to report it.
- [What to do after a phishing attack](https://www.phishclean.com/blog/what-to-do-after-phishing-attack): the first steps, in order.
- [How to remove fake virus popups](https://www.phishclean.com/blog/how-to-remove-fake-virus-popup): for warnings that keep coming back.

## Check something now

- [Phishing link checker](https://www.phishclean.com/check-link): paste a URL before you open it.
- [Phishing email checker](https://www.phishclean.com/tools/phishing-email-checker): paste a message and see the red flags.
- [QR code scanner](https://www.phishclean.com/tools/qr-scanner): see where a code leads before you visit it.

## The data behind these guides

Our [phishing URL statistics](https://www.phishclean.com/research/phishing-urls) count where live phishing links are hosted, using PhishTank's verified list. For ways to protect yourself automatically, see how the [best anti-phishing browser extensions](https://www.phishclean.com/compare/best-anti-phishing-browser-extensions) compare.

Last updated: 6 November 2026