A new phishing campaign is ditching hosted websites and assembling malicious login pages inside a victim’s browser, rather than on a server that security tools can scan and block, according to Barracuda research.
The attack uses blob URLs, temporary browser-generated links that point to content held in local memory rather than on the web, to render the phishing page. Because the page never exists as a persistent, retrievable URL, conventional detection tools can’t flag it in advance.
The campaign begins with a DocuSign-themed email carrying a calendar invite attachment. The invite isn’t malicious on its own; it points to a legitimate Microsoft OAuth endpoint, making the email feel like routine business correspondence. A crafted redirect parameter then funnels the victim through Microsoft Teams, which loads external content from a domain identified as cdn. bloom[.]io. The browser converts that content into a blob URL, rendering the phishing interface locally.
From there, service workers and sandboxed iframes take over, managing requests and navigation within the browser session itself. Backend infrastructure sends live instructions via browser messaging, giving attackers real-time control over the workflow. Evidence suggests that this is part of a centrally managed phishing platform rather than a one-off page.
Because the entire chain routes through trusted Microsoft infrastructure, including login.microsoftonline.com and Teams, users and automated scanners see little that looks obviously malicious.
Barracuda researchers argue this shift means defenders need to move past URL blocklisting toward behaviour- and identity-based detection. Recommended measures include monitoring OAuth redirect chains for unexpected destinations, inspecting blob URL activity tied to login workflows, flagging suspicious service worker registrations from external sources, deploying phishing-resistant MFA such as FIDO2 keys and passkeys, and analysing full click paths rather than initial links alone.
Users should also be wary of unsolicited document-signing requests, the report notes, even when surrounding links appear to route through legitimate Microsoft services. As phishing execution moves further into the browser itself, the malicious page may never exist anywhere a defender can find or stop it in advance.
