Barracuda observed a real phishing campaign that avoids hosting a traditional fake website. Instead, victims are led through Microsoft Teams to load a resource that their browser converts into a “blob URL,” rendering the phishing page only inside the victim’s browser, making it harder for scanners and blocklists to catch.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: you get a DocuSign email with a calendar invite attached, and it all opens inside Microsoft Teams. You click, get bounced through a crafted redirect into Teams, which quietly loads cdn.bloom.io. Your browser turns that into a blob URL, so the phishing page lives only inside your browser, there’s almost nothing for filters to block. Here’s the trick: it looks like a normal sign-in, wrapped in trusted Microsoft assets, but you got there from an unexpected DocuSign email, through Teams, and now a blob URL login pops up out of nowhere. If a DocuSign request sends you through Teams and then a surprise login or blob URL appears, stop, don’t sign in. Report it to security right away.
Researchers described a real phishing campaign where victims click through legitimate Microsoft services and end up on a fake login page that is generated inside their own browser. The phishing page uses a temporary “blob URL” (not a normal website) and can disappear after the session, making it…
Researchers reported a real phishing campaign that uses legitimate Microsoft OAuth and Teams pages to make the journey look trustworthy. Instead of hosting a fake login site on a suspicious domain, the attackers render the phishing page inside the victim’s own browser using a temporary “blob URL,”…
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
A China-linked espionage group (UAT-11587) targeted Asian government and policy organizations using highly tailored phishing emails and realistic decoy documents. After a click, malware ultimately installed the “Antino” backdoor, which then hid its command-and-control traffic inside normal…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
