Phishing hides pages in browser via blob URLs

Barracuda researchers have identified a phishing technique that builds malicious pages inside a user’s browser by converting an externally hosted resource into a blob URL. The rendered pages exist only in browser memory and have no persistent web page for scanners to inspect.

The campaign starts with a DocuSign-themed email that includes a calendar invite to make the message appear legitimate. A crafted redirect moves the recipient into Microsoft Teams, which then loads an asset hosted on cdn.bloom[.]io. The browser converts that asset into an in-memory blob URL and displays the phishing page to the user.

Because the content is delivered through trusted Microsoft assets and created in memory, traditional URL-based defenses and domain filters may not flag a static malicious page. Barracuda’s analysis shows the phishing workflow runs inside the browser and uses service workers, iframes and backend controls to manage navigation and collect user input.

Researchers found a hidden command-and-control configuration in the platform, indicating operators can update pages and steer attacks across multiple victims from a central service.

The report recommends focusing on identity protection, browser security and behavioral detection. It lists measures such as inspecting browser activity that creates blob URLs, monitoring OAuth authorization flows for unexpected destinations, and using email security that analyzes the full click path rather than relying only on the initial URL.

Barracuda’s findings note attackers are using legitimate platforms and browser features to deliver malicious content inside browsers. The campaign requires a user to be routed to an external resource, but the routing is obscured by trusted processes, which can limit the visibility of these attacks to existing endpoint and email filters.