Hackers Use Blob URLs and Microsoft Teams to Create Phishing Pages Inside Victims’ Browsers
Barracuda details a phishing campaign using Microsoft Teams OAuth redirects and browser blob URLs to render local fake DocuSign login pages for credential theft.
Barracuda researchers identified an active phishing campaign that routes DocuSign-themed emails with calendar invites through a Microsoft OAuth endpoint and crafted redirects into Microsoft Teams, then renders a fake sign-in page via a browser-generated blob URL. Because the page is assembled locally in memory and can register service workers and run in a sandboxed iframe, URL-reputation checks largely see legitimate Microsoft domains. The goal is credential theft and account takeover, not a flaw in Teams itself.
- Blob URL renders the phishing page locally, evading link-reputation filters that inspect destinations.
- Redirect chain abuses legitimate Microsoft OAuth and Teams to make early stages look benign.
- Page supports service workers, sandboxed iframe execution, and remotely steered behavior.
- Recommended defenses include FIDO2 keys/passkeys and inspection of full redirect paths.
- Organizations
- Barracuda
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bloom.io | f compromise (IoCs):- Type Indicator Description Domain cdn.bloom[.]io External resource host loaded through the Microsoft Teams |
| domain | login.microsoftonline.com | st loaded through the Microsoft Teams redirect chain Domain login.microsoftonline.com Legitimate Microsoft OAuth endpoint used in the initial red |
From the original article
4 min read at cybersecuritynews.com
A new phishing campaign is moving fake login pages into victims’ browsers. Rather than sending people to a malicious website, its operators use browser-generated blob URLs to assemble the page in local memory, leaving less for security tools to inspect before it appears. The operation starts with a DocuSign-themed email carrying a calendar invitation.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.