New Phishing Attack Uses Blob URLs to Hide Malicious Pages From Security Scanners
Barracuda detailed a DocuSign-themed phishing campaign that renders credential-harvesting pages as browser blob URLs, evading URL reputation and blocklist defenses.
Barracuda researchers report a credential-harvesting phishing campaign that starts with a DocuSign-themed email containing a calendar invitation and routes victims through legitimate Microsoft OAuth endpoints and Microsoft Teams. A crafted redirect parameter leads Teams to load external content from cdn.bloom[.]io, which the browser renders as a blob URL — a session-only address held in local memory with no persistent public URL to crawl, categorize, or blocklist. The locally generated page registers a service worker, runs inside a sandboxed iframe, and is dynamically steered by backend infrastructure, indicating a centrally managed phishing platform. Barracuda recommends phishing-resistant MFA such as FIDO2 keys and passkeys, monitoring OAuth flows and redirect chains, and Teams malicious URL protection.
- Blob URLs hold phishing content in browser memory with no persistent public URL to detect or blocklist
- Attack chain routes through Microsoft OAuth and Teams before loading content from cdn.bloom[.]io
- Page uses service workers, sandboxed iframes, and backend control to adjust the flow per victim
- Barracuda recommends FIDO2 keys, passkeys, OAuth flow monitoring, and full click-path inspection
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bloom.io | r ultimately leads Teams to load external content from cdn. bloom[.]io. Rather than displaying that content as a normal external |
From the original article
3 min read at gbhackers.com
A phishing campaign that moves the credential-harvesting page out of attacker-controlled web infrastructure and into the victim’s browser. Unlike ordinary phishing kits, which host cloned login portals on domains that can eventually be detected and disrupted, this campaign delivers malicious content assembled only after a user follows the attack chain. A blob URL is a […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.