Barracuda observed a real phishing campaign that avoids hosting a traditional fake website. Instead, victims are led through Microsoft Teams to load a resource that their browser converts into a “blob URL,” rendering the phishing page only inside the victim’s browser, making it harder for scanners and blocklists to catch.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: you get a DocuSign email with a calendar invite attached, and it all opens inside Microsoft Teams. You click, get bounced through a crafted redirect into Teams, which quietly loads cdn.bloom.io. Your browser turns that into a blob URL, so the phishing page lives only inside your browser, there’s almost nothing for filters to block. Here’s the trick: it looks like a normal sign-in, wrapped in trusted Microsoft assets, but you got there from an unexpected DocuSign email, through Teams, and now a blob URL login pops up out of nowhere. If a DocuSign request sends you through Teams and then a surprise login or blob URL appears, stop, don’t sign in. Report it to security right away.
Researchers reported a real phishing campaign that uses legitimate Microsoft OAuth and Teams pages to make the journey look trustworthy. Instead of hosting a fake login site on a suspicious domain, the attackers render the phishing page inside the victim’s own browser using a temporary “blob URL,”…
Researchers describe BraZetsu, a Windows malware framework used by an initial-access broker to turn infected PCs into "access for sale" on a criminal marketplace. While the malware itself is technical, the article includes real-world delivery details pointing to phishing: victims are tricked into…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
Google says three suspected Russian espionage clusters are targeting academics, think tanks, diplomats, and related nonprofit staff by abusing legitimate login and verification workflows that may not look like “classic phishing.” The campaigns include app-password scams, OAuth/device-code tricks,…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
Check Point says North Korea’s Lazarus Group targeted defense and aerospace professionals using convincing fake job offers that led victims to download trojanized PDF software. The campaign used a Windows zero-day (now patched as CVE-2026-68820) to gain full control and hide from security tools,…
