Phishing Campaign Uses Blob URLs and Microsoft Services to Bypass Detection

Barracuda researchers have identified an email phishing campaign that generates fake login pages directly in a victim's browser. This attack uses legitimate Microsoft services as part of its delivery chain.

The attackers create a fake page in the browser using a blob URL, which is a temporary address pointing to content held in local memory rather than on a public web server. This makes it harder for security teams to detect the threat in advance.

The campaign routes victims through Microsoft infrastructure, including login.microsoftonline.com and Microsoft Teams. The use of legitimate services reduces some visual clues that might raise suspicion.

Barracuda recommends monitoring OAuth authorisation flows and redirect chains for unusual destinations, as well as inspecting browser activity involving blob URLs when they are used to display login pages or authentication steps. Phishing-resistant multifactor authentication methods, such as FIDO2 security keys and passkeys, can also reduce the damage from credential theft.