Barracuda researchers find attackers abusing legitimate Microsoft services to deliver phishing pages without a traditional web server
Barracuda researchers have published an analysis of an email attack campaign that replaces the traditional phishing website with a phishing page generated directly inside the victim’s browser using blob URLs. A blobURL is a temporary browser-generated address that points to content stored locally in memory rather than on a website. Victims are routed through legitimate Microsoft services, making the attack appear trustworthy and reducing common warning signs.
What makes this attack noteworthy?
- There is no phishing page to block. The phishing content is never hosted on a conventional webpage and exists only within a specific browser session. This means that there is no persistent phishing URL for security tools to retrieve, analyse or blocklist in advance.
- Trusted Microsoft services are abused throughout the attack chain. Rather than directing victims to an obviously suspicious website, the attack routes them through legitimateMicrosoft infrastructure, including login.microsoftonline.com and Microsoft Teams. Because users appear to remain within trusted Microsoft services throughout the attack chain, they may be less likely to identify the activity as malicious.
- The phishing attack runs largely within the browser. Once the blob-based phishing page loads, it registers a service worker – a browser component that can manage network requestsand page behaviour in the background. Part of the workflow is also executed inside a sandboxed iframe – an isolated browser window embedded within the page. Together, these elements help control navigation, manage requests and coordinate the phishing experiencewithout relying on a conventional phishing website.
- Dynamic attacker control. The phishing workflow receives instructions from backend infrastructure using browser messaging mechanisms. Because the attack is controlled dynamicallyrather than through hardcoded redirects, operators can modify destinations and behaviour in real time.
- Added legitimacy. The email includes a calendar invitation file as a benign attachment. While not part of the malicious payload, it helps the message resemble routine businesscommunication and increases recipient trust.
“This campaign demonstrates how phishing is evolving beyond fake websites and suspicious domains, removing many of the indicators that security teams have traditionally relied on for detection,” said Ashitosh Deshnur, Associate Threat Analyst at Barracuda. “Organisations should focus on identifying malicious behaviour and strengthening identity-based controls rather than simply blocking known phishing URLs.”
Key defensive measures include:
- Monitoring OAuth authorisation flows and redirect chains for unusual or unexpected destinations.
- Inspecting browser activity involving blob URLs, particularly when they are used to render login pages or authentication workflows.
- Detecting suspicious service worker registrations associated with externally sourced content.
- Applying phishing-resistant multifactor authentication methods such as FIDO2 security keys and passkeys.
- Using email security controls that analyse the full click path rather than relying solely on the initial URL.
- Training users to be cautious of unexpected document-signing requests, even when links appear to use trusted Microsoft infrastructure.
