Phishing Evolves: Fake Login Pages Built Inside Victims' Browsers

Cybercriminals have developed a new phishing technique that assembles fake login pages entirely inside victims' browsers, bypassing traditional detection methods. This campaign starts with a DocuSign-themed email carrying a calendar invite attachment, which is not the payload.

The attack then redirects victims to Microsoft Teams, where a resource hosted on an external domain loads a phishing page from a blob URL within the victim's machine. The page registers a service worker and runs part of its logic inside a sandboxed iframe, allowing attackers to send live instructions through browser messaging.

Barracuda researchers warn that this campaign demonstrates how phishing is evolving beyond fake websites and suspicious domains, making it harder for security teams to detect. They advise users to watch OAuth authorization flows and redirect chains, inspect blob URL activity in login contexts, and flag service worker registrations tied to externally loaded content.

Barracuda also recommends strengthening identity-based controls, such as using phishing-resistant MFA like FIDO2 keys or passkeys, and training staff to question document-signing requests. By identifying malicious behavior and focusing on identity-based controls, organizations can better protect themselves against these evolving threats.