Phishing Attacks Evolve to Render Malicious Pages Within Victim's Browser
A novel phishing technique leverages trusted Microsoft services to host malicious pages directly within the victim's browser using blob URLs, bypassing traditional detection methods.
Phishing campaigns are evolving beyond traditional methods, with a new technique observed by Barracuda that hosts malicious pages directly within the victim's browser. This innovative approach utilizes blob URLs to dynamically generate these pages, significantly hindering the ability of security scanners to detect and block phishing attempts that previously relied on static website analysis.
The attack flow begins similarly to standard phishing, requiring the victim to be directed to an external resource. However, this campaign obfuscates the redirection process by routing users through trusted Microsoft services. The initial step involves a Docusign-themed email containing a calendar invite, which, while irrelevant to the attack itself, serves to legitimize the communication and lower the recipient's guard.
From the Docusign email, a carefully crafted redirect directs the user to Microsoft Teams. Within Teams, the user is prompted to load an external resource hosted on cdn.bloom[.]io. It is this resource that the browser then processes to create a blob URL, effectively rendering the phishing page entirely within the user's browser environment. This method bypasses the need for a distinct, externally hosted phishing website.
Because this process is integrated with trusted Microsoft assets, it carries an inherent air of legitimacy, making it less likely to trigger alarms. This stealthier approach offers a significant advantage over traditional static external phishing web pages, which are more easily identified and blocked by security controls.
The phishing page generated via the blob URL exists exclusively within the victim's browser session. Barracuda's analysis indicates that service workers, iframes, and backend controls manage the subsequent phishing workflow and user navigation. Furthermore, a hidden command and control configuration reveals that these automatically constructed phishing pages are part of a managed platform, allowing for centralized operation, updates, and steering across multiple victims simultaneously.
This campaign highlights the increasing sophistication of phishing attacks, which are moving beyond fake websites and suspicious domains. Attackers are reducing the traditional indicators that security teams have relied upon for detection, as there is no physical page to block. The researchers emphasize that future phishing detection will require a greater focus on identity protection, browser security, and behavioral analysis.
To combat this evolving threat, security strategies should include closer inspection of browser activity, particularly involving blob URLs. Monitoring OAuth authorization flows for unexpected destinations and employing email security controls that analyze the full click path, rather than just the initial URL, are also crucial steps. This shift in focus is necessary to stay ahead of attackers who are adept at leveraging legitimate services for malicious purposes.