A new phishing campaign is moving fake login pages into victims’ browsers. Rather than sending people to a malicious website, its operators use browser-generated blob URLs to assemble the page in local memory, leaving less for security tools to inspect before it appears.
The operation starts with a DocuSign-themed email carrying a calendar invitation. Its link initially reaches a Microsoft OAuth endpoint, then follows a crafted redirect into Microsoft Teams.
That trusted route can make a document request look routine while concealing where harmful content enters the browsing session.
Barracuda researchers identified the campaign and said it replaces the hosted phishing site with a page created inside the browser.
The technique adds pressure to phishing defenses already strained by attacks abusing collaboration tools, including recent Microsoft Teams phishing activity. The immediate danger is credential theft and account takeover, not a flaw in Teams itself.
A user who sees a convincing sign-in prompt may submit work credentials or approve a follow-on request, giving criminals access to email, cloud files, or other business services connected to that identity.
Barracuda said in a report shared with Cyber Security News (CSN) that the workflow reduces the warning signs used by users and scanners. The campaign shows why familiar brands and apparently safe web addresses cannot alone prove a login page is legitimate.
Hackers Use Blob URLs and Microsoft Teams
A blob URL is a temporary address created by a browser for data held in a session. Here, Teams loads an external resource and the browser converts it into a blob URL that displays the phishing interface locally. The page is not an attacker-hosted destination that filters can retrieve and assess in advance.
That difference matters because many email filters begin by checking where a link goes. When the visible path includes legitimate Microsoft services, early stages may look benign.
The malicious interface can emerge only after the redirect sequence finishes, similar to other blob URL phishing techniques reported this year. The researchers said the page can register a service worker and run activity in a sandboxed iframe.
These browser features help the page handle requests and navigation in the active session. Criminals can also send instructions from remote infrastructure, changing destinations or behavior without rebuilding every lure.
The calendar invite is not the harmful payload, but it plays a social-engineering role. It makes the email resemble a meeting request that a worker may expect.
This use of business context echoes a wider pattern of phishing attacks exploiting OAuth redirects to disguise the route to a fake sign-in experience.
Detection Must Follow Behavior
Security teams should examine the full click path, not the first URL in a message. Unusual OAuth authorization requests, unexpected redirect destinations, and blob URLs used to display sign-in forms deserve review.
Browser telemetry can also reveal suspicious service-worker registration tied to externally supplied content. Organizations can reduce exposure by applying phishing-resistant sign-in methods, including FIDO2 security keys and passkeys, with identity controls.
These approaches make a captured password less useful on its own. Teams should pause over surprise signature or calendar requests, even when Microsoft branding and domains appear genuine.
Email defenses need to follow redirections through trusted services and test the content that ultimately loads. Responders should preserve browser logs, identity events, and email headers, because the page may disappear when the session closes.
These steps complement defenses against credential theft through session-cookie phishing, which seeks access after multifactor authentication.
The campaign also reinforces the need to separate platform abuse from a platform compromise. Teams and OAuth are transit points, while attacker-controlled material is introduced later and rendered locally. Blocking one known domain may help, but detection based on unusual behavior chains will be more durable.
For employees, the practical rule is straightforward: open document-signing or meeting requests through a known internal workflow, not an unexpected message.
If a sign-in page appears after a calendar invite or redirect, close it and verify the request separately. Fast reporting lets defenders review the chain before others click.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Domain | cdn.bloom[.]io | External resource host loaded through the Microsoft Teams redirect chain |
| Domain | login.microsoftonline.com | Legitimate Microsoft OAuth endpoint used in the initial redirect path |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
Click Here For The Original Source.
