Barracuda observed a real phishing campaign that avoids hosting a traditional fake website. Instead, victims are led through Microsoft Teams to load a resource that their browser converts into a “blob URL,” rendering the phishing page only inside the victim’s browser, making it harder for scanners and blocklists to catch.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: you get a DocuSign email with a calendar invite attached, and it all opens inside Microsoft Teams. You click, get bounced through a crafted redirect into Teams, which quietly loads cdn.bloom.io. Your browser turns that into a blob URL, so the phishing page lives only inside your browser, there’s almost nothing for filters to block. Here’s the trick: it looks like a normal sign-in, wrapped in trusted Microsoft assets, but you got there from an unexpected DocuSign email, through Teams, and now a blob URL login pops up out of nowhere. If a DocuSign request sends you through Teams and then a surprise login or blob URL appears, stop, don’t sign in. Report it to security right away.
Researchers described a real phishing campaign where victims click through legitimate Microsoft services and end up on a fake login page that is generated inside their own browser. The phishing page uses a temporary “blob URL” (not a normal website) and can disappear after the session, making it…
Researchers reported a real phishing campaign that uses legitimate Microsoft OAuth and Teams pages to make the journey look trustworthy. Instead of hosting a fake login site on a suspicious domain, the attackers render the phishing page inside the victim’s own browser using a temporary “blob URL,”…
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
EU regulators are investigating Booking.com over phishing, fraudulent listings, and impersonation scams affecting travelers and accommodation partners. The article describes several real campaigns, including fake Booking.com messages that sought payment details from customers and complaint-themed…
Attackers are using fake calendar invitations to bypass normal email defenses and lure people into credential theft or malware downloads. The invites may appear in a user’s calendar even when the related phishing email is quarantined, making unexpected meeting entries a new route for account and…
Attackers sent large volumes of fake Microsoft 365 calendar invitations designed to steal employee credentials. The messages use familiar meeting requests, including apparent Microsoft Teams invitations and calendar files, to direct users to phishing pages. Some invitations can remain on an…
