Back Securityweek

New Phishing Attack Creates Malicious Pages Inside the Victim's Browser

Securityweek • September 9, 2026

Barracuda has analyzed a new type of phishing campaign that adds both stealth and flexibility to traditional phishing. Rather than standard social engineering to persuade a target to visit a static compromised web page, this campaign generates a blob URL to render and deliver the phishing page inside the target’s own browser. This reduces the possibility of security scanners detecting either the social engineering email or the static residence of the phishing page.

The attack flow is similar to standard phishing since the victim must be steered to an external resource. In this campaign, however, the steering is obfuscated through trusted processes. It starts with a Docusign-themed email with an attached calendar invite. The calendar invite is irrelevant to the attack but makes the email appear to be a legitimate business communication.

A crafted redirect routes the user to Microsoft Teams, which then loads an external resource hosted on cdn.bloom[.]io. It is this resource that is converted by the browser into the blob URL that renders the phishing page existing only within the browser.

Since this process is wrapped up in trusted Microsoft assets, it has all the hallmarks of being trustworthy and is likely to trigger no alarms, providing improved stealth over traditional static external phishing web pages.

The blob-created phishing page exists solely within the victim’s browser. Barracuda’s analysis shows that service workers, iframes and backend controls manage the subsequent phishing workflow and user . A hidden command and control configuration also demonstrates that this automatically constructed phishing page is not a simple stand-alone, but part of a managed platform that can be centrally operated, updated and steered across multiple victims simultaneously.

This campaign demonstrates that attackers’ use of blob URL-created phishing pages can add greater flexibility as well as improved stealth to phishing. “This campaign demonstrates how phishing is evolving beyond fake websites and suspicious domains and reducing many of the indicators that security teams have traditionally relied upon for detection,” write the researchers. There is no phishing page to block.

Future phishing detection, say the researchers, will require greater emphasis on identity protection, browser security and behavioral detection – there is no physical page that might trigger an alarm. Techniques should include closer inspection of browser activity involving blob URLs; monitoring OAuth authorization flows for unexpected destinations; and using email security controls that analyze the full click path rather than relying solely on the initial URL.

Related : New Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets

Related : FBI, Google Dismantle ‘Outsider Enterprise’ Phishing Service

Related : Over 500 Organizations Hit in Years-Long Phishing Campaign

Related : Microsoft Warns of Sophisticated Phishing Campaign Targeting US Organizations

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Browser-Based Phishing Campaign Uses Blob URLs for Stealth Attacks A new phishing campaign analyzed by Barracuda uses blob URLs to create malicious pages directly within victims' browsers, bypassing traditional detection methods. The attack begins with a DocuSign-themed email that includes a calendar invite, making it appear legitimate. Victims are redirected through trusted Microsoft services, including Microsoft Teams and OAuth endpoints, before the phishing page is rendered locally using a blob URL. This approach eliminates the need for a persistent phishing site, complicating detection efforts. The campaign demonstrates a significant evolution in phishing tactics, emphasizing the need for enhanced browser security and behavioral detection methods. Currently, there are no known CVEs specifically associated with this attack, but it poses a serious risk to organizations relying on traditional phishing detection methods. 5 sources 70

Extracted Entities

New Phishing Attack Creates Malicious Pages Inside the Victim's Browser

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Domains (1)

MITRE ATT&CK (1)

Tools (2)