New Browser-Based Phishing Campaign Uses Blob URLs for Stealth Attacks

A new phishing campaign analyzed by Barracuda researchers employs blob URLs to generate phishing pages directly within victims' browsers. This method enhances stealth by avoiding traditional phishing site detection, as the phishing content is not hosted on a conventional webpage. Victims receive a DocuSign-themed email with a calendar invitation, which appears legitimate. The attack routes users through trusted Microsoft services, including Teams, making it difficult for security tools to identify malicious activity. The phishing page is dynamically controlled using service workers and iframes, allowing attackers to modify the phishing experience in real-time. This campaign highlights the evolution of phishing tactics, moving away from static sites to more sophisticated browser-based attacks. Security professionals are advised to enhance monitoring of browser activities and OAuth flows to detect such threats.

Key Points: • Attackers use blob URLs to create phishing pages within victims' browsers, enhancing stealth. • The phishing campaign routes victims through trusted Microsoft services, reducing detection risk. • Dynamic control of the phishing experience allows attackers to modify tactics in real-time.