New Browser-Based Phishing Campaign Uses Blob URLs for Stealth Attacks

• •Phishing pages are generated inside victims' browsers using blob URLs.
• •Attackers leverage trusted Microsoft services to enhance legitimacy.
• •Traditional phishing detection methods are ineffective against this technique.

A new phishing campaign analyzed by Barracuda uses blob URLs to create malicious pages directly within victims' browsers, bypassing traditional detection methods. The attack begins with a DocuSign-themed email that includes a calendar invite, making it appear legitimate. Victims are redirected through trusted Microsoft services, including Microsoft Teams and OAuth endpoints, before the phishing page is rendered locally using a blob URL. This approach eliminates the need for a persistent phishing site, complicating detection efforts. The campaign demonstrates a significant evolution in phishing tactics, emphasizing the need for enhanced browser security and behavioral detection methods. Currently, there are no known CVEs specifically associated with this attack, but it poses a serious risk to organizations relying on traditional phishing detection methods.