The Vulnerability
Attack the Glass is a weakness in the way modern screens are put together. It lets someone other than the company you are dealing with change what appears on your screen, and what your screen does, at the moment it is assembled in front of you. The company cannot see what appeared on your device. You cannot see what the company meant to send. Neither of you has any way to compare the two, so neither of you learns that anything was changed.
Your Device Builds the Screen
Most people picture a web page or an app screen as a finished thing that a company sends them, the way a printer sends out a newspaper. In the early years of the web that picture was accurate. A company's own computer, called a server, put the whole page together and sent it out complete, and your browser simply displayed what it received. Engineers call that server-side rendering, because the work of drawing the page was done there.
For more than a decade it has worked differently. When you open a modern site or app, the company sends a set of instructions, and your phone or laptop builds the screen itself, on the spot. The instructions are written in a programming language called JavaScript, which every web browser can run, and a modern page is less a document than a small program that starts up each time you open it. Following those instructions, your device collects dozens or hundreds of separate resources, most of them from other companies: program code, fonts, images, video players, advertising, maps, chat windows, sign-in and payment services, tools that measure what visitors do, and increasingly AI services. Engineers call this client-side rendering. The client is your device, and rendering is the work of drawing the screen. The period while that program is running on your device, fetching and assembling and redrawing, is called runtime.
Building a screen this way is the difference between buying a finished table and receiving a sheet of instructions that tells you to collect the legs from one supplier, the top from another, and the screws from a third.
Take an ordinary article on a news site. The words of the article come from the publisher. The typeface comes from a font company. The video at the top plays in a player supplied by a video company. Each advertisement is sold in an automated auction that runs in the fraction of a second while the page loads, and the winning advertiser, whom the publisher has never met, supplies its own code. A measurement service counts the visit. Another tool tests two versions of the headline against each other. The comment box, the share buttons, the newsletter sign-up, and the cookie consent banner each come from a different firm. Surveys of the web find that more than nine pages in ten load resources from outside companies, and a typical page makes about eighty such requests.
The pattern is not limited to web pages in a browser. Most phone apps are built with kits of ready-made code from other companies, and many display web content inside the app. Smart televisions, the screens in cars, check-in kiosks, and a growing share of industrial and medical displays are built on the same web technology, because it is cheap, flexible, and familiar to every programmer. A page built the older way, on the company's server, does not escape either. It still loads outside resources for advertising, measurement, payments, and sign-in, and those still run on your device with the full run of the page.
Companies build screens this way for good reasons. It is faster, it is cheaper, and it lets them use excellent services they could never afford to create themselves. It also moves the final act of assembly out of the company's hands. The screen you look at is put together on your device, in the moment before you see it, from resources the company does not make, does not store, and in most cases never sees.
That moment of assembly, on your device, is where Attack the Glass takes place. The attack does not happen on the company's computers, and nothing crosses the defenses the company has built around them. It happens on your phone, your laptop, your television, the display in your car, in the instant the screen is being assembled. Nobody is guarding that instant. The company's security team cannot see into your device, and you were never told there was anything to guard.
A Supply Chain Nobody Sees
Every one of those resources comes from a supplier, and most suppliers have suppliers of their own. The mechanism is almost absurdly simple. A developer adds a single line to the page that says, in effect, "fetch whatever is at this web address and run it." That line is called a script tag. The trust it grants belongs to the address. It says nothing about the contents, and the supplier can change what sits at that address at any time, which is how suppliers deliver updates and the reason companies like the arrangement.
A company adds a chat window from another firm. The chat window brings in a tool from a third firm, which pulls in something from a fourth. Many companies also use a tag manager, a tool that lets the marketing department add new outside scripts to the site without asking a programmer, and often before anyone in security hears about it. Your device fetches all of it and runs all of it as though it came from the company whose name is at the top of the screen.
Browsers do have a rule for keeping websites apart, called the same-origin policy. A page from one site cannot read or change a page from another, which is why a shopping site open in one tab cannot look at your bank in the next. The rule stops at the door, though. An outside script that a page has invited in runs as part of that page, with the page's full powers. It can read everything you type, including passwords and card numbers, and it can rewrite anything you see. Programmers call the live, editable structure of a page the Document Object Model, or DOM, and any script on the page may change any part of it at any moment, including long after the page has finished loading.
Whoever controls any one of those resources can change what it delivers. When they do, the change is injected into the screen as your device builds it, which is why the technical name for this kind of attack is a supply chain injection. One altered resource is enough. It can rewrite the words on the page, replace a number, add a form, remove a button, or change what happens when you press one. All of it appears under the brand of the company you thought you were dealing with.
This has been done, many times, for theft. In 2018 attackers altered the code of a chat service that Ticketmaster had placed on its payment pages, and it quietly copied customers' card details as they typed. The same year, 22 lines of added code on the British Airways site sent the personal and payment details of more than 400,000 people to a server the thieves controlled, and the United Kingdom's data protection regulator later fined the airline 20 million pounds. The security industry calls this web skimming, or Magecart after the criminal groups that pioneered it, and it has hit thousands of online shops. In March 2016, visitors to the websites of the New York Times, the BBC, and other major publishers were served advertisements that tried to install ransomware. None of those publishers had been hacked. The poisoned ads arrived through the advertising supply chain, and the industry gave that a name too: malvertising.
Those cases were about stealing, which leaves victims who eventually notice missing money. The thieves used the very access Attack the Glass describes. Code that can copy a card number off a page can just as easily change a paragraph on it.
Forced Trust and Blind Trust
Two kinds of trust hold this arrangement together, and neither involves anybody checking anything.
The first is forced on you. The company's developers decided which outside suppliers your device would fetch from and run. Your device does as it is told. You were never shown the list, never asked to agree to it, and cannot look at what any supplier on it actually sends. You cannot turn one of them down and keep using the app. Tools such as ad blockers can refuse a supplier outright, but no tool can inspect what an accepted one delivered. The trust is real and binding, and someone else entered into it on your behalf.
The second is blind, and it belongs to the company. Most of those suppliers were chosen because they are popular, well known, and often free. Millions of other sites use them, which feels like safety in numbers. Hardly anyone verified what the code does, who owns the firm behind it, or who that firm depends on in turn. Ask most organizations to name every company whose resources load on their screens and they cannot, because no such list has ever been written down. Nobody approved the full set, because it has never been seen in one place.
A small episode from 2016 shows how deep the dependence runs and how little of it anyone sees. A programmer, annoyed by a dispute over a name, deleted a tiny piece of free code he had published for others to use. It was eleven lines long and did one trivial job: padding out the left side of a line of text. Within hours, software projects around the world stopped building, including tools relied on by companies such as Facebook and Netflix and by thousands of smaller ones. Almost none of them knew the code existed, because they had never chosen it. A tool they relied on had pulled in another, which depended on those eleven lines.
The person at the screen trusts the company. The company trusts its suppliers on reputation, and they in turn trust theirs the same way. Everyone in the chain is trusting, and nobody in it is verifying.
Swapping What You See
What an attacker does from that position is simple to describe: swap one thing on the screen for another. We call it Content Swapping. The account number on a payment page becomes a different one. The telephone number for the bank's fraud line becomes the attacker's own. One paragraph of a news story is replaced. A lab result, a dose, a price, an interest rate, a delivery address, a chart, or a download link is exchanged for another. A warning is taken off the page, or the button that would have let you cancel.
Follow one case through. A bookkeeper at a small construction firm signs in to a supplier's online portal to pay an invoice, as she does every month. The address is right, the padlock is showing, her password works, and the invoice on the screen has the right amount and reference number. The bank account number printed under "pay to" belongs to someone else. It was swapped on her screen by an altered resource from one of the portal's outside suppliers. She types the number into her bank, exactly as the screen shows it, and approves the payment. The supplier's records still hold the true account number. The bank processes a valid payment from an authorized customer. Three weeks later the supplier asks why it has not been paid, and each side can show the other records proving it did everything correctly.
Criminals have already shown that this kind of swap deceives people at scale. From 2007, families of bank-fraud software, first Zeus and later SpyEye, infected millions of home computers and then waited for the owner to visit a bank. When the bank's page loaded, the software changed it inside the victim's browser, adding fields, hiding transactions, and replacing payee account numbers, and customers approved transfers they believed they had written themselves. Banks called the technique a man-in-the-browser attack. It needed malicious software installed on each victim's computer, which antivirus companies eventually learned to find. Attack the Glass produces the same altered page with nothing installed on anybody's computer.
The swap can happen after the page has loaded, while you are already reading it. It can last for a few seconds and then be put back. With generative AI running on the device, the replacement can be written on the spot for the one person looking at it, in their language, about their town, their employer, or their money.
Everything else on the screen stays exactly as it should be, which is what makes the altered part believable.
No Alarms, Because No One Is Watching
A company hit this way does not have a failing security team. Its defenses were built to protect what the company runs, its own computers, networks, and data, and this attack never touches them.
Nearly every security check in use today inspects a thing before it is used. Code is reviewed before it is published. Software is scanned before it is installed. A supplier is approved before it is added to a list. Once a resource has passed and started running on your device, nothing looks at it again. The kitchen passed its inspection. The plate was changed between the kitchen and the table.
Detection is the usual answer when prevention fails, and here detection has nothing to work with. There is no malicious file to find, because nothing resembling harmful software is ever installed. There is no fake website to block, because the source is one the company deliberately chose. There is nothing odd in the company's records, because every computer the company owns behaved normally. Security tools are built to catch bad software from a bad source. This is harm done with clean software from a trusted one.
In the common case today, nothing on the device is watching either. No mainstream browser, app platform, or device checks, while a screen is running, that the resources it fetched are the ones it was supposed to receive. The deeper cause is in the design of the platforms themselves, which were built to fetch whatever a trusted address returns and run it.
What About the Protections We Already Have?
People who work in security will point to a list of protections at this stage. Every one of them is real and worth having, and each stops short of the moment this attack uses.
The padlock. The padlock in the address bar stands for HTTPS, the encryption that protects a web connection, which engineers also call TLS. It guarantees two things: that you are connected to the genuine address, and that nobody altered the traffic on its way to you. It makes no promise about what the owner of that address chose to send. If a supplier's address is under an attacker's control, or has changed hands, encryption faithfully protects the delivery of the altered content.
Firewalls and the company's own monitoring. A firewall, its web application cousin, and the monitoring systems that collect security records all watch the company's own computers and networks. The exchange between your device and an outside supplier never passes through them.
Antivirus. Antivirus software, and the corporate version usually called endpoint detection, looks for malicious programs installed on a device. Nothing is installed here. A script running inside a browser tab is what browsers are for.
Code review, scanning, and ingredient lists. Careful companies review their code, scan it for known flaws, and increasingly keep a software bill of materials, a list of the ingredients built into a product before it ships. All of that examines software at rest, before release. It does not cover what a running page fetches from other companies afterward.
App stores and code signing. Phone apps are reviewed by the app store and carry a digital signature proving who made them. The review and the signature cover the app as it was submitted. Many apps then fetch content, settings, and sometimes program code from the internet every time they run, and none of that passes back through the store.
Content Security Policy. Content Security Policy, or CSP, lets a site give the browser a list of the addresses it may load from. It is the most useful control available in a browser today, and it is a list of approved senders. It approves the sender, not the package. When an approved address sends altered content, the policy has done its job and the change runs.
Subresource Integrity. Subresource Integrity, or SRI, is the closest thing the web has to a tamper-evident seal. The site records a digital fingerprint of a resource, and the browser refuses anything that does not match. It is worth using, and it has three limits. It is optional, and most sites do not use it. It cannot be applied to a resource that is supposed to change from one visit to the next, which describes a large share of what modern pages load, advertising and measurement scripts among them. And it checks a resource once, as it arrives. A script that passes the check can go on to fetch fresh instructions while it runs, so the code is genuine and the harm arrives in the data.
Zero Trust. Zero Trust is the security model most large organizations are now adopting, and the name suggests it should cover this. It is a model for deciding who and what is allowed to reach a company's systems, checked every time, before access is granted. It has nothing to say about whether content is still correct after it has been delivered to someone's screen.
Ad blockers. Ad blockers, script blockers, and corporate filtering can refuse a supplier altogether, and they work. None of them can inspect what a permitted supplier sent, or accept one on conditions.
Cross-site scripting. Security professionals will notice a family resemblance to cross-site scripting, or XSS, one of the oldest attacks on websites. XSS exploits a mistake in one particular site, which that site's owner can find and fix. Attack the Glass needs no mistake anywhere. The site correctly fetches from an address it was set up to trust, and the device correctly runs what that address returned. Nothing is broken, so there is nothing to patch.
No Trace and No Proof
A burglar leaves a broken lock. A forger leaves the forged check. Most cyberattacks leave something behind as well: a malicious file on a disk, an unfamiliar address in a log, a record that an investigator can find later and hold up as evidence.
An altered screen leaves nothing. The changed content lives in the memory of the device for as long as that one session lasts. Close the tab, quit the app, switch off the television, park the car, and it is gone. The attacker also decides whether the device keeps a copy at all. Browsers save copies of what they download, in a store called the cache, so that pages load faster next time, and the server that sends each resource also sends an instruction saying how long to keep it: a year, an hour, or, with the instruction "no-store," not at all. An attacker sends the altered version once, marked to be stored nowhere, and answers every later request with the genuine one, including the investigator's.
The traffic that carried it was encrypted, as it should be, so anything watching the network saw a trusted device talking to a trusted address, which it does thousands of times a day. The publisher's own computers recorded an ordinary visit, because from their side it was one.
When a customer says "your site told me to send the money there," the company has nothing to check the claim against. It cannot reproduce what that person saw. Neither can the customer, a regulator, a court, or a forensic examiner.
A screenshot would help, and almost nobody takes one of a page that looks normal. One taken afterward shows the genuine page. And because a screenshot is trivial to fake, it proves little even when it exists.
When a person's account and a computer's records disagree, institutions side with the machine. A notorious modern example is the British Post Office scandal. Between 1999 and 2015 more than 900 people who ran local post offices were prosecuted for theft and false accounting because a bookkeeping system called Horizon showed money missing from their branches. The system was faulty. It took two decades, a public inquiry, and an act of Parliament to clear them, and the courts had begun from a legal presumption that a computer's records are correct. A customer who says "the screen told me to" starts from the same disadvantage, with the added problem that in this case the company's records really are accurate. The false version never touched them.
It is nearly impossible to defend against an attack you cannot detect. It is harder still when you cannot prove afterward that it ever happened. An attack that is delivered to a chosen few, passes every security check, exists only in memory, and vanishes when the screen goes dark is silent, invisible, unprovable, and unattributable. Nobody can say who did it, because nobody can show that anything was done.
Aimed at You
An attacker never has to change a screen for everybody. Someone who controls one advertising or visitor-tracking resource on a news site can, within the same hour and from the same web address readers have always used, send the real page to most readers, an altered paragraph to readers in one country, a different alteration to readers whose browsing marks them as likely voters or likely buyers, and the real page again to anyone who looks like a security researcher, a fact-checker, or a rival newsroom. Each reader sees one version and cannot see anyone else's. The publisher's own computers handle none of it.
Showing one face to the inspector and another to everyone else has a name, cloaking, and a long record. Volkswagen's diesel cars, exposed in 2015, carried software that recognized the conditions of an emissions test and ran clean for the test, then polluted at up to forty times the legal limit on the road. In 2017 Uber was found to have used a tool called Greyball, which identified city officials trying to catch its drivers operating illegally and showed them a fake version of the app, populated with ghost cars that never arrived. In 2024 altered code served from a widely used web address, polyfill.io, did the same thing. It checked what kind of device was asking, checked again inside the browser, looked at which site the visitor had come from and at the time on the device's clock, and acted on only a sample of visits, all to stay out of sight of the people most likely to investigate.
None of this is exotic. Every advertisement slot on a modern page is sold in an automated auction, known as real-time bidding, in which advertisers bid for one particular viewer based on what is known about that person. An advertising platform already sells targeting by country, device, time of day, past purchases, and membership of a commercial or political segment, and those same controls decide who receives the altered page. Reaching a hundred thousand people who share one characteristic costs an attacker no more effort than reaching one person, because advertising companies built the infrastructure to do exactly that.
The political use of that machinery is a matter of record. In 2018 it emerged that the consulting firm Cambridge Analytica had obtained the Facebook profile data of up to 87 million people and used it to sort voters by personality and target them with tailored political messages. Whatever those messages achieved, the episode showed the public how precisely an audience can be sliced, and everything involved in it was ordinary commercial advertising technology.
Targeting does two things for an attacker, and both make the attack worse for everyone else. It makes the deception more effective, because a message shaped for one group, in their language, about their town, their employer, their money, or their fears, persuades better than one written for everybody. And it makes the deception harder to catch, because the people most likely to notice are exactly the ones an attacker leaves out: the publisher's own staff, a security researcher, a regulator, a journalist checking a claim. They load the same address and see the genuine page. The only people who could report the altered version are the ones who received it, and each of them has every reason to believe that what they saw is what everyone saw.
A head of government reads from one screen. A bank's chief executive reads from another. A commander directing a force reads from a third. An attacker who reaches only one of those screens has picked the smallest audience the mechanism allows and, in the same move, the largest consequence it can produce, because the authority of the person reading sets the ceiling. Targeting one named individual on one device is the precision extreme, the finest aim available, and a decision any of those three takes from a false screen needs no second recipient to matter.
How many people to reach and whose screen to reach are two separate choices, and neither limits the other. Narrowing the audience to one narrows nothing except the number of people who could have noticed.
Artificial Intelligence Changes the Scale
Everything described so far could be done by hand, and hand work has been the limit on it. Writing a convincing false paragraph for one reader takes someone who knows that reader: the language, the town, the employer, the worries. Doing it for a million readers used to mean a million hours of skilled labor, which is why precise deception belonged to intelligence services and was aimed at a few people at a time.
Generative artificial intelligence removes that limit. These are the systems, ChatGPT being the best known, that produce text, images, voices, video, and computer code on request. A model can write a paragraph in the style of a particular newspaper, rewrite it for a retired teacher in Ohio and again for a dockworker in Marseille, translate both, and supply a matching photograph, all in seconds and for a fraction of a cent. It can copy a person's voice from a few seconds of recorded speech. In 2024 a video call built with tools of this kind, in which every face and voice was fake, cost one company in Hong Kong 25 million dollars.
Attack the Glass and AI each supply what the other lacks. AI can manufacture a convincing falsehood for every person on earth, and it still needs a channel those people trust, which is why the Doppelganger campaign had to build imitation news sites and hope nobody looked at the address. Attack the Glass is that channel: delivery inside the genuine site, to a chosen audience, with no trace. Without AI, an operator has to write every alteration by hand. With it, the operator describes the goal and the model writes a separate version for each reader.
Three further developments tie the technologies together more tightly.
AI now runs on the device. New phones, laptops, and web browsers carry AI models that work on the device itself, without calling out to a distant data center. A model running inside the same program that draws the screen can compose the replacement text on the spot, using whatever that program is permitted to know about the person in front of it: their language, their location, the page they are reading, and often a good deal more. Nothing crosses the network, so nothing watching the network sees it happen. No two people receive the same words, and that removes the last handhold defenders have. The filters that catch spam and scam websites work because the same fake reaches thousands of inboxes and someone reports it. A deception written once, for one reader, on that reader's own device, belongs to a population of one.
AI products are built on the Glass. Chat assistants, the AI answers that now sit above search results, and the AI helpers inside email and office software all reach people as screens assembled on the device from outside resources, like any other modern application. The answer itself is fetched while the screen is running, which makes it exactly the kind of ever-changing resource that no fingerprint check can cover. People are quickly learning to trust these answers, and a new mental shortcut is forming in real time: the assistant said so. An answer swapped on the Glass carries all of the assistant's authority.
AI reads the Glass too. AI agents now browse websites, compare prices, summarize documents, and fill in forms on behalf of people and companies. A model does not judge whether what it reads is true. It works with what it is given. Text on a page can even carry instructions aimed at the AI and invisible to a human reader, a technique known as prompt injection. A person might notice that a figure looks wrong. An automated reader will not, it acts at machine speed, and the people downstream receive its output as analysis.
AI is also a proliferating technology. Capable models can be downloaded free of charge, run on an ordinary computer, and stripped of the safety limits their makers built in. No earlier technology with this much potential for misuse has spread so far, so quickly, to so many hands.
Weapons of Mass Deception
Put the pieces together at the scale of a population. Attack the Glass delivers inside the sources people already trust. Commercial advertising technology chooses who receives what. AI writes a separate version for every audience, or every person. At population scale this is the delivery layer for an influence operation: different segments receive different manipulated versions in the same hour, generative AI tailors each one, and no shared version is left for anyone to compare against or to fact-check.
We call the upper bound of this weapons of mass deception, and we name it to mark the stakes, not to claim it is happening today.
Picture the final days before an election, the first hours of a bank panic, or the middle of a public health emergency. Each group of citizens sees its own version of events on the news sites, government pages, and apps it already relies on. Older voters in one district read that their polling place has moved. Customers of one bank see a notice that withdrawals are suspended. Parents in one city find that the official guidance on a vaccine has changed. Every one of those pages sits at its genuine address, under its genuine name.
Four things set this apart from every influence operation on record. It arrives inside trusted sources, where earlier campaigns had to compete with them from outside using fake accounts and imitation sites. It leaves no single false story for anyone to debunk, because no two groups saw the same one, and the journalists and fact-checkers who load those addresses find nothing wrong. It leaves no evidence, so nobody can show afterward what was done, to whom, or by whom. And it is cheap enough to be within reach of far more actors than a government.
The damage would go beyond whatever each false message achieved. A society argues, votes, and governs itself on the assumption that its members are looking at the same record, even when they disagree about what it means. An operation of this kind removes the common record without anyone seeing it go.
The name deliberately echoes weapons of mass destruction, for three reasons: the effect lands on whole populations at once, there is no practical defense at the moment of use, and the capability is spreading. Every ingredient exists now. The targeting machinery is a commercial product. The AI is free. The delivery was demonstrated on a hundred thousand websites by polyfill.io. What nobody can say is whether anyone has yet put them together, because an operation of this kind would leave nothing behind to find.
Deceive, Disrupt, Degrade, Deny, Destroy
An attacker in position can do five different things to a screen. Each one works on its own, each suits a different purpose, and nothing stops an attacker combining them.
Deceive. The screen shows something false, and everything else works perfectly. A trader sees holdings the firm does not have. A nurse sees a dose that nobody prescribed. A shopper sees a price, a voter sees a headline, a loan applicant sees terms, and each of them then does exactly what a sensible person would do with that information. The person is who they say they are, the action is one they are allowed to take, and every record behind the screen shows a normal transaction, because from that side it was one. Machines can be deceived the same way. An alarm that watches a temperature does not judge whether the number it receives is true. If the number says normal, it stays silent. The best-known demonstration is Stuxnet, an earlier attack on industrial control equipment that used the same logic: the monitoring screens replayed recorded normal readings while the machinery was driven to failure. Deception matters most because it turns an organization's own trusted people, and its own safety systems, into the instrument.
Disrupt. A feature is still on the screen, still looks like it works, and quietly does nothing. A password reset completes and sends no email. A button for reporting fraud returns a confirmation and files nothing. An employee submits a safety concern, sees "thank you, your report has been received," and it goes nowhere. What makes disruption dangerous is that both sides believe the job was done. The person thinks they have acted, so they do not try again or pick up the phone. The organization receives no complaints, so it concludes nothing is wrong. On a web page that exists mainly to be read, there are only so many functions worth breaking. On a control panel, where nearly everything on the screen is a function, there are a great many: the acknowledge button, the alarm, the emergency stop.
Degrade. Everything still works, and works worse. Pages load a few seconds slower. A search takes long enough that people give up. A checkout drags until customers abandon their carts, and the company books the loss as a marketing problem, because nothing is broken and no alarm has any reason to fire. Online retailers have known for years that small delays cost real sales, which makes degradation a quiet weapon against a competitor: aimed at one company's checkout during its busiest week, it costs that company money and customers and never looks like an attack. Where timing is the whole point, the stakes are higher. An order that reaches the stock market two seconds late is filled at a different price. A control command that must arrive within a fixed window, and arrives after it, might as well not have been sent.
Deny. Something the person needs is not there. The button to dispute a charge is missing from the page. The link to appeal a decision does not appear. A sign-in is refused, a route does not load, a notice never shows. Anyone who has hunted through an account page for a cancel button knows how effective simple absence is, and that was only poor design. Done on purpose and aimed at the right moment, denial locks a customer out while a deadline passes, hides an evacuation notice from one district, or keeps an operator from the one control the situation calls for. Denial can reach a single person or every user of a service, and everything behind the screen stays healthy throughout. Support lines hear "I can't find it," and the company's own staff, looking at their unaltered screens, see it right where it should be.
Destroy. The attacker's code reaches through the screen and damages what is behind it. The first four effects all happen on the Glass. This one goes through it. Code running inside a screen can do whatever the signed-in person is allowed to do, and when that person is a system administrator, that includes deleting stored files, erasing databases, wiping the list of user accounts, or sending a bad update to every device an organization owns. Organizations that have lived through ransomware know what it means to lose systems for weeks. Here the damage arrives through a page the administrator opens every morning, from a source the organization chose to trust. The administrator signs in, reads the dashboard, and sees nothing unusual. Behind that ordinary screen, the code is already deleting the backups.
The effects combine naturally. A benefits decision is changed from approved to denied, and the button to appeal it is removed from the same page. The applicant reads the decision, looks for a way to contest it, finds none, and gives up. In every case, what sits behind the screen sets the limit, far more than the attacker's skill.