tokens: With the capability to open a given URL in a browser , the actor behind ‘ SimBad ’ can generate phishing pages for multiple platforms and open them in a browser , thus performing spear-phishing attacks on the user .