Barracuda researchers have published an analysis of an email attack campaign that replaces the traditional phishing website with a phishing page generated directly inside the victim's browser using blob URLs. A blob URL is a temporary browser-generated address that points to content stored locally in memory rather than on a website. Victims are routed through legitimate Microsoft services, making the attack appear trustworthy and reducing common warning signs.
What makes this attack noteworthy?
There is no phishing page to block. The phishing content is never hosted on a conventional webpage and exists only within a specific browser session. This means that there is no persistent phishing URL for security tools to retrieve, analyze or blocklist in advance.
Trusted Microsoft services are abused throughout the attack chain. Rather than directing victims to an obviously suspicious website, the attack routes them through legitimate Microsoft infrastructure, including login.microsoftonline.com and Microsoft Teams. Because users appear to remain within trusted Microsoft services throughout the attack chain, they may be less likely to identify the activity as malicious.
The phishing attack runs largely within the browser. Once the blob-based phishing page loads, it registers a service worker – a browser component that can manage network requests and page behavior in the background. Part of the workflow is also executed inside a sandboxed iframe – an isolated browser window embedded within the page. Together, these elements help control navigation, manage requests and coordinate the phishing experience without relying on a conventional phishing website.
Dynamic attacker control. The phishing workflow receives instructions from backend infrastructure using browser messaging mechanisms. Because the attack is controlled dynamically rather than through hardcoded redirects, operators can modify destinations and behavior in real time.
Added legitimacy. The email includes a calendar invitation file as a benign attachment. While not part of the malicious payload, it helps the message resemble routine business communication and increases recipient trust.
"This campaign demonstrates how phishing is evolving beyond fake websites and suspicious domains, removing many of the indicators that security teams have traditionally relied on for detection," said Ashitosh Deshnur, Associate Threat Analyst at Barracuda. "Organizations should focus on identifying malicious behaviour and strengthening identity-based controls rather than simply blocking known phishing URLs."
Key defensive measures include:
Monitoring OAuth authorization flows and redirect chains for unusual or unexpected destinations.
Inspecting browser activity involving blob URLs, particularly when they are used to render login pages or authentication workflows.
Detecting suspicious service worker registrations associated with externally sourced content.
Applying phishing-resistant multifactor authentication methods such as FIDO2 security keys and passkeys.
Using email security controls that analyze the full click path rather than relying solely on the initial URL.
Training users to be cautious of unexpected document-signing requests, even when links appear to use trusted Microsoft infrastructure.
𝐒𝐭𝐚𝐲 𝐢𝐧𝐟𝐨𝐫𝐦𝐞𝐝 𝐰𝐢𝐭𝐡 𝐨𝐮𝐫 𝐥𝐚𝐭𝐞𝐬𝐭 𝐮𝐩𝐝𝐚𝐭𝐞𝐬 𝐛𝐲 𝐣𝐨𝐢𝐧𝐢𝐧𝐠 𝐭𝐡𝐞 WhatsApp Channel now! 👈📲
𝑭𝒐𝒍𝒍𝒐𝒘 𝑶𝒖𝒓 𝑺𝒐𝒄𝒊𝒂𝒍 𝑴𝒆𝒅𝒊𝒂 𝑷𝒂𝒈𝒆𝐬 👉 Facebook, LinkedIn, Twitter, Instagram