Wikipedia is not very explicit on this,

The exploit employs scripts to rewrite a page of average interest with an impersonation of a well-known website, when left unattended for some time.

What is 'tabnabbing', how does one do it?

2 Answers 2


Tabnabbing is a phishing technique where a malicious web site changes its looks while the tab is inactive in order to trick the user into entering credentials.

This page is simultaneously a description and a demo. When you visit it, it shows a description of what tabnabbing is. When you then click another tab, it changes the tabs favicon and title to look like Gmail. Later, when the user wants to read her mail she goes to this tab thinking it is Gmail and enters her credentials.


In this animation, you see that while I am reading SE, the tab that at first looked harmless changes in the background to look like Gmail. This way the page tries to trick me into submitting my credentials.

Tabnabbing demo

  • 9
    Seems like the demo page you provided has been sort of broke since 2015. Sep 8, 2016 at 12:24
  • 9
    Indeed the screenshot of Gmail no longer shows.
    – Sjoerd
    Sep 8, 2016 at 13:05
  • 103
    Lost 5 minutes waiting for the favicon to change, and then I remembered that I have NoScript enabled -.-
    – Bakuriu
    Sep 8, 2016 at 15:30
  • 10
    Another good reason to just close tabs you're done with instead of letting them pile up.
    – Shelby115
    Sep 8, 2016 at 17:20
  • 14
    Here's a more effective demo created by Eitan Adler which uses meta refresh to open the demo phishing page.
    – Daniel
    Sep 8, 2016 at 18:43

It is a form of social engineering attack through your web browser. You are asked to visit a malicious page which will only get loaded if you switch to another tab and back. There are some tools around to do this. Best for me is Social Engineering Toolkit. It comes pre-installed with Kali Linux along with other useful toys.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .