Barracuda spots blob URL phishing in Microsoft browser

Hackers Use Blob URLs and Microsoft Teams to Create Phishing Pages Inside Victims’ Browsers

A new phishing campaign is moving fake login pages into victims’ browsers. Rather than sending people to a malicious website, its operators use browser-generated blob URLs to assemble the page in local memory, leaving less for security tools to inspect before it appears. The operation starts with a DocuSign-themed email carrying a calendar invitation. Its […]

Cyber researchers issue warning over 'phishing pages that exist only inside the victim’s browser'

Barracuda has uncovered an email phishing campaign that lures victims with a phishing page generated directly inside the victim's browser.

Cybercriminals are building phishing pages that exist only inside victims’ browsers

A phishing campaign routes victims through genuine Microsoft OAuth and Teams infrastructure before showing them a fake login page built entirely inside their own browser, according to researchers at Barracuda. “Instead of delivering a phishing page from a web server, the malicious content is assembled inside the victim’s browser using a blob URL — a temporary browser-generated URL that points to content stored locally in memory rather than on a …

Cybercriminals are building phishing pages that exist only inside victims' browsers

A phishing campaign routes victims through genuine Microsoft OAuth and Teams infrastructure before showing them a fake login page built entirely inside their own browser, according to researchers at Barracuda. “Instead of delivering a phishing page from a web server, the malicious content is assembled inside the victim’s browser using a blob URL — a temporary browser-generated URL that points to content stored locally in memory rather than on a …

Barracuda spots blob URL phishing in Microsoft browser

Security teams may miss the attack because it leaves no persistent phishing site, instead building fake Microsoft login pages inside the browser.