DocuSign-themed phishing campaign renders fake login pages inside victims' browsers using blob URLs, Microsoft OAuth, and Teams

Barracuda researchers detailed a credential-harvesting phishing campaign that lures victims with DocuSign-themed calendar invites, routes them through genuine Microsoft OAuth endpoints and Teams to content on cdn.bloom[.]io, and assembles the fake sign-in…

According to Barracuda research covered by Help Net Security, GBHackers, and Cyber Security News (all published 2026-09-10), an active phishing campaign begins with DocuSign-themed emails containing calendar invitations that point to legitimate Microsoft OAuth endpoints. Crafted redirect parameters then route victims through Microsoft Teams to a resource hosted on cdn.bloom[.]io. The phishing login page is not hosted at a fixed web address: the browser itself assembles it from a blob URL, a session-only address held in local memory, so URL-reputation checks and blocklists largely see only legitimate Microsoft domains. The locally generated page registers a service worker, runs inside a sandboxed iframe, and receives live instructions from the attacker's backend. Hidden command-and-control configuration indicates the page is part of a centrally managed phishing platform that can be updated and steered across many victims. The goal is credential theft and account takeover; the reports note this is not a flaw in Teams itself. Barracuda recommends phishing-resistant MFA such as FIDO2 keys or passkeys, monitoring of OAuth flows and full redirect-chain inspection, Teams malicious URL protection, and behavior-based identity controls rather than relying on URL blocklisting.

• Campaign starts with DocuSign-themed emails carrying calendar invites that point to genuine Microsoft OAuth endpoints.
• Crafted redirect parameters chain victims through Microsoft Teams to external content hosted on cdn.bloom[.]io.
• The phishing page is assembled client-side as a blob URL held in browser memory, with no persistent public URL to crawl, categorize, or blocklist.
• The page registers a service worker and executes inside a sandboxed iframe, receiving live instructions from the attacker's backend.
• Hidden C2 configuration indicates a centrally managed phishing platform that can be updated and steered per victim across many targets.
• Objective is credential theft and account takeover; the technique is not a vulnerability or flaw in Microsoft Teams itself.
• Recommended defenses: phishing-resistant MFA (FIDO2 keys or passkeys), OAuth flow monitoring, full redirect-chain/click-path inspection, Teams malicious URL protection, and behavior-based identity controls.
• Attributed to Barracuda researchers; coverage by Help Net Security, GBHackers, and Cyber Security News, all dated 2026-09-10, with consistent accounts.