Cybercriminals are building phishing pages that exist only inside victims’ browsers

A phishing campaign routes victims through genuine Microsoft OAuth and Teams infrastructure before showing them a fake login page built entirely inside their own browser, according to researchers at Barracuda.

“Instead of delivering a phishing page from a web server, the malicious content is assembled inside the victim’s browser using a blob URL — a temporary browser-generated URL that points to content stored locally in memory rather than on a website,” researchers explained.

The attack starts with a DocuSign-themed email carrying a calendar invite as an attachment. The invite is not the payload. It exists to make the message look like an ordinary meeting request, and the approach works because it points to a genuine Microsoft OAuth endpoint rather than anything obviously suspicious.

Phishing email impersonating DocuSign (Source: Barracuda)

A crafted redirect parameter then sends the victim to Microsoft Teams. Teams loads a resource hosted on an external domain, cdn.bloom[.]io, which ultimately results in the phishing page being rendered from a blob URL entirely on the victim’s machine.

Once it loads, the page registers a service worker and runs part of its logic inside a sandboxed iframe. Those components let the attacker’s backend send live instructions to the page through browser messaging, allowing the operators to change what the victim sees without relying on a hardcoded redirect.

“Hidden command-and-control configuration shows this is not a standalone page but part of a managed phishing platform that can be centrally operated, updated and steered across many victims at once,” researchers noted.

Barracuda urges stronger identity controls

Barracuda advised users to watch OAuth authorization flows and redirect chains for unexpected destinations, inspect blob URL activity in login or authentication contexts, and flag service worker registrations tied to externally loaded content.

It also recommended phishing-resistant MFA such as FIDO2 keys or passkeys, email security tools that follow a link’s entire path rather than just the first hop, and training staff to question document-signing requests even when they run through trusted Microsoft infrastructure.

“This campaign demonstrates how phishing is evolving beyond fake websites and suspicious domains, removing many of the indicators that security teams have traditionally relied on for detection,” said Ashitosh Deshnur, Associate Threat Analyst at Barracuda.

“Organizations should focus on identifying malicious behaviour and strengthening identity-based controls rather than simply blocking known phishing URLs,” Deshnur concluded.