Barracuda spots blob URL phishing in Microsoft browser

Barracuda researchers have identified an email phishing campaign that generates fake login pages directly in a victim's browser. The attack uses legitimate Microsoft services as part of the delivery chain.

Unlike the standard model, in which criminals host a phishing page on a separate website and lure users to it, this campaign creates the fake page in the browser with a blob URL. A blob URL is a temporary address that points to content held in local memory rather than on a public web server.

That means there is no conventional phishing site for security teams to inspect or add to blocklists before an attack reaches users. The page exists only within the active browser session, making it harder for automated tools that scan web addresses and hosted content to detect the threat in advance.

Victims are routed through Microsoft infrastructure, including login.microsoftonline.com and Microsoft Teams. Keeping users within familiar services for much of the process reduces some of the visual clues that might otherwise raise suspicion.

How it works

Once the blob-based page loads, the attack registers a service worker, a browser feature that can handle requests and influence page behaviour in the background. Part of the process also runs inside a sandboxed iframe, an isolated window embedded in a webpage.

Those browser components help manage navigation and requests without requiring a traditional phishing website. They also shift much of the activity into the browser itself, rather than relying on visible redirects to a suspicious external domain.

Backend systems still play a role. The analysis found that the phishing workflow receives instructions from remote infrastructure through browser messaging tools, allowing the operators to change destinations and behaviour while the attack is under way.

That dynamic control lets attackers alter the experience in real time instead of embedding every step in a fixed redirect chain. It also creates another obstacle for defenders, because the content and flow shown to one target may differ from what another user sees.

Trusted route

The email also includes a calendar invitation file as an attachment. The file is not malicious on its own, but it helps the message resemble routine office communication and may make recipients more likely to trust the request.

The use of well-known cloud services in the attack chain reflects a wider pattern in cybercrime, with criminals increasingly relying on legitimate platforms to mask malicious activity. Security products and users often assign greater trust to recognised domains, particularly those linked to large software providers.

For corporate security teams, that creates a problem that domain reputation checks alone cannot solve. If a user appears to be interacting with familiar Microsoft pages before a phishing screen appears in memory inside the browser, some standard warning signs may be absent.

The findings underline the limits of detection methods built mainly around malicious URLs. With no persistent web page to fetch and inspect, defenders must focus more closely on browser behaviour, authorisation flows and identity protections.

Barracuda recommends monitoring OAuth authorisation flows and redirect chains for unusual destinations, and inspecting browser activity involving blob URLs when they are used to display login pages or authentication steps. Suspicious service worker registrations tied to external content are another area for scrutiny.

On the user protection side, researchers highlighted phishing-resistant multifactor authentication methods such as FIDO2 security keys and passkeys. These controls can reduce the damage from credential theft by making it harder for attackers to reuse stolen usernames and passwords.

Email security tools should also analyse the full click path rather than only the first URL in a message. User awareness remains part of the defence, particularly when staff receive unexpected document-signing or approval requests that appear to come through trusted Microsoft services.

"This campaign demonstrates how phishing is evolving beyond fake websites and suspicious domains, removing many of the indicators that security teams have traditionally relied on for detection," said Ashitosh Deshnur, Associate Threat Analyst at Barracuda.

"Organisations should focus on identifying malicious behaviour and strengthening identity-based controls rather than simply blocking known phishing URLs," Deshnur said.