Researchers described a real phishing campaign where victims click through legitimate Microsoft services and end up on a fake login page that is generated inside their own browser. The phishing page uses a temporary “blob URL” (not a normal website) and can disappear after the session, making it harder for security tools to block using traditional URL lists.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “DocuSign: Signature requested, meeting invite attached.” Looks routine, calendar invite and all. You open the invite, click the link, and it bounces through real Microsoft OAuth and Teams pages. So your brain goes, “Okay, this is safe.” Here’s the trick: Teams quietly loads content from cdn.bloom.io, your browser turns it into a temporary blob URL, and a fake Microsoft 365 login appears that can vanish without leaving a normal phishing site to block. If a DocuSign email comes with a surprise calendar invite or a login flow that suddenly flips to a weird blob URL, stop. Don’t sign in, report it to Security immediately.
Researchers reported a real phishing campaign that uses legitimate Microsoft OAuth and Teams pages to make the journey look trustworthy. Instead of hosting a fake login site on a suspicious domain, the attackers render the phishing page inside the victim’s own browser using a temporary “blob URL,”…
Barracuda observed a real phishing campaign that avoids hosting a traditional fake website. Instead, victims are led through Microsoft Teams to load a resource that their browser converts into a “blob URL,” rendering the phishing page only inside the victim’s browser, making it harder for scanners…
This roundup describes multiple real-world campaigns where attackers trick people into installing malicious software that looks legitimate (a fake Claude desktop app, a fake emergency alert app, and banking-malware phishing). The common pattern is “looks normal, feels urgent,” leading users to…
The recap describes a real Microsoft 365 phishing campaign using DocuSign-themed emails that push victims through multiple redirects to a fake sign-in page. The goal is to steal session tokens (so attackers can log in even if a password changes) and also perform “device code” style sign-in abuse.…
This weekly roundup includes multiple real-world social-engineering and phishing-style operations, including fake recruiter outreach pushing malicious Android apps, phishing emails that trick users into installing remote management tools, and vishing that reportedly led to compromised Okta…
Researchers describe BraZetsu, a Windows malware framework used by an initial-access broker to turn infected PCs into "access for sale" on a criminal marketplace. While the malware itself is technical, the article includes real-world delivery details pointing to phishing: victims are tricked into…
