Cyber researchers issue warning over 'phishing pages that exist only inside the victim’s browser'

Barracuda has uncovered an email phishing campaign that lures victims with a phishing page generated directly inside the victim's browser.

Rather than building a traditional phishing website, the campaign creates a fake page in the browser with a blob URL - a temporary address that points to content held in local memory rather than on a public web server.

Victims are routed through legitimate Microsoft services, including Microsoft OAuth and Microsoft Teams, making the site appear trustworthy and reducing common warning signs.

"This campaign demonstrates how phishing is evolving beyond fake websites and suspicious domains, removing many of the indicators that security teams have traditionally relied on for detection," said Ashitosh Deshnur, associate threat analyst at Barracuda.

How the phishing attack works

The attack begins with a DocuSign-themed email with a calendar invite attached. It doesn't appear malicious, because it points to a legitimate Microsoft OAuth endpoint; it's there just to add legitimacy.

A crafted redirect then routes the user to Microsoft Teams, which loads an external resource hosted on cdn.bloom[.]io. The browser converts this content into a blob URL that renders the phishing page locally within the browser.

Once the blob-based phishing page loads, it registers a service worker – a browser component that can manage network requests and page behavior in the background.

Part of the workflow is also executed inside a sandboxed iframe: an isolated browser window embedded within the page. Together, these elements help control navigation, manage requests and coordinate the phishing experience without the need for a conventional phishing website.

A hard to tackle campaign

It's a worrying technique, Barracuda warned. There's no phishing page to block, and therefore no persistent phishing URL for security tools to retrieve, analyze or blocklist in advance.

Trusted Microsoft services are abused throughout the attack chain, making the attack harder to spot, and the calendar invitation file makes the message look like routine business communication.

The phishing workflow receives instructions from backend infrastructure using browser messaging mechanisms; and, because the attack is controlled dynamically rather than through hardcoded redirects, operators can modify destinations and behavior in real time.

This gives them a level of flexibility and evasiveness that's not typically seen in static phishing pages.

New scanning techniques are needed

The campaign shows that detection approaches built around scanning for known malicious URLs are no longer good enough, said Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress.

"Traditional email security tools, URL scanners, and web filters are looking for malicious destinations. This approach removes the destination entirely; the attack surface exists only inside the target's browser for the duration of the session, then disappears," he said.

Patel said blob URLs mean detection needs to “shift toward behavioral monitoring of what the browser is actually doing” – such as URL creation in “unusual contexts” and “anomalous behaviour following calendar invite interactions”.

“These are detectable patterns, but they require endpoint-level visibility rather than network or email gateway scanning.”

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.