Cybercriminals are using blob URLs to generate phishing pages directly in the browser to avoid detection.
A new report from Barracuda shows that hackers are using a phishing method where phishing pages are no longer hosted on traditional web servers. Instead, attackers use blob URLs: temporary addresses created and stored locally by the browser. As a result, the phishing content only exists during the victim’s browser session, preventing security tools from analyzing or blocking a permanent URL.
A key feature of this attack is the abuse of legitimate Microsoft services. Victims are redirected via trusted platforms such as login.microsoftonline.com and Microsoft Teams, making the attack appear trustworthy and reducing user suspicion. This undermines the effectiveness of common phishing warning signs.
In-browser attack techniques
The phishing attack takes place largely within the browser. Once the blob URL is loaded, a service worker is registered. This browser component manages network requests and page behavior, allowing attackers to maintain control without a real phishing website. Part of the attack occurs via a sandboxed iframe, an isolated window in the browser that provides extra protection against detection.
Furthermore, the attack workflow is dynamic. Instructions from the attacker’s infrastructure can adjust behavior and destination in real time. Consequently, security systems cannot rely on known redirects or fixed patterns, and the attack remains undetected by traditional detection methods.
Attackers increase the credibility of their emails by adding a calendar invitation as an attachment. Although this attachment is not harmful, it ensures the communication feels normal and professional, increasing the risk of successful phishing.
Measures
Barracuda advises organizations to shift their focus from blocking known phishing URLs to recognizing malicious behavior. It is important to monitor OAuth processes and redirect chains for unusual destinations. Additionally, it is recommended to analyze browser activity surrounding blob URLs, especially when they are used for authentication.