Why the browser became the target
Walk through your own workday and count the tabs. Email, accounting, payroll, your CRM, your bank, your website dashboard — for most small businesses in the DMV, the entire company now runs inside a web browser. The office firewall never sees any of it, because the traffic is encrypted and the applications live in someone else's data center.
Attackers have adjusted. Instead of breaking into your server, they go after the thing that already holds the keys: the browser on your laptop. If they control that, they control your email, your invoices, and your money. That is why I tell clients the browser is now part of the security perimeter, not just a tool for reading the news.
The four attacks I actually see
- Malicious extensions. A browser extension is a small add-on program, and a bad one can read every page you visit, including passwords as you type them. Extensions also get sold: a safe one you installed years ago can change owners and turn hostile in a routine update.
- Stolen session cookies. A session cookie is the small file that keeps you logged in so you do not retype your password all day. Malware that grabs it lets an attacker walk into your account already logged in.
- Fake login pages. Look-alike sign-in pages, often promoted through search ads, harvest the password and the one-time code in real time.
- Unmanaged profiles. Staff sign into work apps on personal browser profiles, sync passwords to personal accounts, and keep access after they leave. Nobody can see it, so nobody can fix it.
Why MFA alone does not save you
Multi-factor authentication — the code from your phone — stops an attacker who only has a password. It does not stop one who has your session cookie, because the cookie is created after you passed the MFA check. To the website, the thief simply looks like you, already signed in.
This matters because many owners hear that they have MFA and stop thinking about the browser entirely. MFA is still non-negotiable; I would never run a business without it. But it protects the front door, and cookie theft climbs through the window. The fixes for the window are different: clean extensions, an up-to-date browser, and short session lifetimes on your most sensitive accounts, like banking, so a stolen cookie expires before it can be used.
Browser policies that cost nothing
Most of what fixes this is policy, not products.
- Separate work from personal. Every employee gets a dedicated browser profile signed into the business account, and work apps live only there.
- Allowlist extensions. Pick the handful your team genuinely needs and block the rest. Google and Microsoft both let you enforce this on managed browsers at no cost.
- Force updates. Browser updates patch the exact holes cookie-stealing malware uses. Set them to apply automatically and relaunch the browser, not wait politely for one.
- Use a password manager. Beyond memory relief, it fills passwords only on the exact real domain. On a fake login page it stays silent — a free, automatic phishing alarm that protects your least technical employee.
- Type addresses for money sites. For the bank and payroll, use a bookmark, never a search result.
Paid controls worth evaluating
Once the free policies are in place, three paid controls give the best return for a small team.
Managed browser control planes, like Chrome Enterprise Core, are free or nearly free and let you push the extension allowlist and update rules to every machine from one screen instead of walking desk to desk.
DNS filtering, usually 2 to 4 dollars per user per month, quietly blocks connections to known malicious sites, which stops many fake login pages before they load.
Phishing-resistant MFA, meaning hardware security keys or passkeys, ties your login to the real website address so a look-alike page physically cannot complete a sign-in. Keys cost roughly 25 to 50 dollars each. I put them on email admin accounts and bank access first, since those two accounts can be used to reset everything else.
What to do this week
- Open the extensions page on your own browser and remove anything you cannot name a reason for keeping.
- Turn on automatic browser updates for every work machine and confirm the version is current.
- Create separate work profiles for anyone mixing personal and business logins in one browser.
- Put the whole team on a password manager and train them that when it refuses to fill, they stop and call.
- List every web app the business signs into, and note who has access — that list is the start of every other control.
An afternoon covers most of this. If you would rather have someone set the managed policies and the allowlist properly, that is the kind of small, fixed-scope project we do at HashWhales for teams around DC, Maryland, and Northern Virginia — but the five steps above stand on their own.