Summary
- The attack passes victims through Microsoft OAuth and Teams infrastructure before rendering phishing content as a local blob URL.
- The final page has no conventional hosted phishing URL for security services to crawl and block in advance.
- Service workers, iframes and remote controls let attackers manage the browser-resident phishing workflow dynamically.
A phishing campaign analysed by Barracuda is generating its final malicious page inside the victim’s browser rather than serving it as a conventional phishing website, reducing the value of some URL-based detection techniques.
The attack uses blob URLs, temporary addresses created by a browser to reference content held locally in memory. By the time the phishing page appears, the victim has already been routed through legitimate Microsoft infrastructure, including Microsoft OAuth and Teams.
Barracuda’s analysis describes a DocuSign-themed email containing a calendar invitation. The link in the invitation points to a legitimate Microsoft OAuth endpoint, helping the message resemble an ordinary business workflow rather than an obvious redirect to attacker infrastructure.
A crafted parameter subsequently routes the victim through Microsoft Teams, which loads an external resource. The browser then converts the retrieved content into a blob URL and renders the phishing page locally.
That architecture changes where the malicious artefact exists. A traditional phishing operation normally hosts a replica sign-in page on a web server. Security services can crawl that address, analyse its content, classify the domain and eventually distribute a blocklist entry.
In the campaign documented by Barracuda, there is no persistent final phishing URL of that kind. The page exists within the browser session after the preceding stages of the attack have executed.
The operators have not eliminated external infrastructure. Remote systems still deliver components and help control the phishing workflow. Barracuda found service workers, sandboxed iframes and backend controls that allow the attackers to manage navigation and update elements of the campaign dynamically.
The technique therefore shifts rather than removes the points available for detection. Email content, redirect behaviour, external resources, browser execution and the final authentication activity can still produce indicators, but a scanner looking only for a stable malicious destination may see an incomplete attack chain.
The use of Microsoft services adds another layer of ambiguity. OAuth and Teams are legitimate enterprise platforms routinely involved in authentication, collaboration and redirection. The campaign abuses those expected workflows without requiring Microsoft itself to be compromised.
That is increasingly common in modern phishing. Rather than relying entirely on a lookalike login domain, attackers can combine trusted cloud services with malicious infrastructure so that each individual step appears less suspicious than the complete sequence.
Blob URLs are also normal browser functionality and cannot simply be treated as malicious. Web applications use them for legitimate local content generation, file handling and media processing. Effective detection therefore depends on context rather than the presence of the mechanism alone.
The campaign reinforces the importance of looking at the identity transaction at the end of a phishing chain. Even where URL reputation is weakened, an attacker still needs the victim’s authentication material or session access to convert deception into an account compromise.
Controls that reduce the reuse of phished credentials can consequently limit the value of a successful phishing page even when the page itself evades earlier layers. At the same time, browser and network telemetry become more important as malicious content moves away from static web infrastructure.
Barracuda’s research provides a useful example of phishing infrastructure adapting to the assumptions built into defensive tooling. The final malicious page has not disappeared; it has moved to a location where conventional scanners have less opportunity to inspect it before the victim does.
