Barracuda researchers have published an analysis of an email attack campaign that replaces the traditional phishing website with a phishing page generated directly inside the victim’s browser using blob URLs. A blob URL is a temporary browser-generated address that points to content stored locally in memory rather than on a website. Victims are routed through legitimate Microsoft services, making the attack appear trustworthy and reducing common warning signs.
Blob URL advantages for attackers:
- There is no phishing page to block. The phishing content is never hosted on a conventional webpage and exists only within a specific browser session. This means that there is no persistent phishing URL for security tools to retrieve, analyse, or blocklist in advance.
- Trusted Microsoft services are abused throughout the attack chain. Rather than directing victims to an obviously suspicious website, the attack routes them through legitimate Microsoft infrastructure, including login.microsoftonline.com and Microsoft Teams. Because users appear to remain within trusted Microsoft services throughout the attack chain, they may be less likely to identify the activity as malicious.
- The phishing attack runs largely within the browser. Once the blob-based phishing page loads, it registers a service worker – a browser component that can manage network requests and page behaviour in the background. Part of the workflow is also executed inside a sandboxed iframe – an isolated browser window embedded within the page. Together, these elements help control navigation, manage requests, and coordinate the phishing experience without relying on a conventional phishing website.
- Dynamic attacker control. The phishing workflow receives instructions from backend infrastructure using browser messaging mechanisms. Because the attack is controlled dynamically rather than through hardcoded redirects, operators can modify destinations and behaviour in real time.
- Added legitimacy. The email includes a calendar invitation file as a benign attachment. While not part of the malicious payload, it helps the message resemble routine business communication and increases recipient trust.
Key defensive measures include:
- Monitoring OAuth authorisation flows and redirect chains for unusual or unexpected destinations.
- Inspecting browser activity involving blob URLs, particularly when they are used to render login pages or authentication workflows.
- Detecting suspicious service worker registrations associated with externally sourced content.
- Applying phishing-resistant multifactor authentication methods such as FIDO2 security keys and passkeys.
- Using email security controls that analyse the full click path rather than relying solely on the initial URL.
- Training users to be cautious of unexpected document-signing requests, even when links appear to use trusted Microsoft infrastructure.
