Phishing Pages Built Inside the Browser: Microsoft Redirects and Blob URLs

1. Basic Information

• Article Title: New Phishing Attack Creates Malicious Pages Inside the Victim's Browser
• Publisher: SecurityWeek / Barracuda
• Publication Date: 2026-09-09
• Original Source: SecurityWeek / Barracuda
• Related Sources: Barracuda primary analysis
• Related Malware, Groups, CVEs, and Products: Microsoft OAuth, Microsoft Teams, Browser Blob URLs, Service Workers, DocuSign
• Priority: High

2. Executive Summary

Barracuda reports a campaign that starts with a DocuSign-themed email, routes users through Microsoft OAuth and Teams, and displays externally retrieved content through a blob URL inside the browser. A blob URL references browser-managed data rather than a conventional page on a web server.

3. Attack Flow

Delivery and page-control path reported by Barracuda

1. A DocuSign-themed email includes a calendar invitation to resemble routine business communication.
2. A crafted redirect parameter routes the user from Microsoft OAuth to Teams.
3. An external resource on cdn.bloom[.]io is loaded through the Teams path.
4. The retrieved content is referenced through a browser-generated blob URL and displayed as a phishing page.
5. Barracuda describes service workers, iframes, and backend instructions controlling navigation. The public description does not establish the registration script URL, origin, or scope.

4. Attacker Position and Execution Environment

• The attacker supplies the lure email and external delivery and control infrastructure. The phishing interface is assembled inside the victim’s browser.

5. What Users and Administrators May See

Users

• A DocuSign-themed request and calendar invitation lead through Microsoft services before a credential-entry screen appears.

Administrators

• Inference: Email and network records may retain the entry link and external fetch destinations, but ordinary proxy logs cannot reconstruct the content displayed through the in-browser blob URL.

6. Success Conditions and Risk Reduction

Success Conditions

• The user opens the lure, and the required redirects and external resource retrieval succeed.
• The browser generates and displays the phishing interface. Credential theft additionally requires the entered information to reach the attacker.

Failure Conditions and Risk Reduction

• Analyze the full click path, including the invitation and external resources.
• Use available browser records to investigate login interfaces displayed through blob URLs and related service-worker activity.
• Deploy phishing-resistant authentication such as FIDO2 security keys and passkeys.

7. Potential Impact

• Disclosure to the attacker if credentials are entered and transmitted.
• Potential evasion of systems that retrieve and classify a stable URL for the final page in advance. External traffic and browser artifacts do not disappear.

8. Observable Logs

Inference: These are investigation sources and their collection requirements.

• Email: Preserve the email, calendar invitation, message ID, URLs, and click records.
• Proxy/SWG/DNS: Trace navigation through Microsoft services and external resource retrieval. The blob URL itself is not an HTTP request destination on an external server.
• Endpoint/EDR: Preserve browser history, screenshots or DOM, scripts, and service-worker registrations where available. Ordinary EDR does not necessarily record all of these.
• Identity/IdP: Review sign-ins, MFA events, and session use for affected accounts. Displaying a fake page does not establish authentication success.
• SaaS/Cloud: Use Microsoft 365 and other SaaS audit records to investigate subsequent email or document access and configuration changes. Passing through Teams does not itself establish tenant compromise.
• Network: Use connections to delivery and control infrastructure as supporting evidence. Distinguish network destinations from URLs generated inside the browser.

9. Assessing Attack Success

The following are evidence criteria for an individual investigation, not claims that each stage occurred. See Facts and Unknowns for the reported scope.

• Attempt observed (success unconfirmed): Evidence criterion: Confirm contact with the email or link. Access to a legitimate Microsoft domain alone is not malicious.
• User interaction confirmed: Evidence criterion: Distinguish clicks, page display, and credential entry.
• Initial execution confirmed: Evidence criterion: Confirm that phishing scripts ran inside the browser. Keep this separate from malware execution at the OS level.
• Malware execution or authentication success confirmed: Evidence criterion: Require separate evidence for an unauthorized sign-in using stolen information or execution of additional malware.
• Data theft or session compromise confirmed: Evidence criterion: Confirm transmission of entered credentials to the attacker or unauthorized session use.
• Follow-on compromise confirmed: Evidence criterion: Verify subsequent email or document access and configuration changes through audit records. Published counts of successful theft are unavailable.

10. Investigation Playbook

Inference: Operational recommendations based on the described behavior.

• Trigger: A DocuSign-themed email leads through Microsoft services to external content and an unexpected login interface.
• Initial Checks: Preserve the email and invitation, then examine the click path and external resources in an isolated analysis environment.
• Endpoint: Preserve browser history, screenshots or DOM, scripts, and service-worker registrations where available. Ordinary EDR does not necessarily record all of these.
• Identity and Cloud: Review sign-ins, MFA events, and session use for affected accounts. Displaying a fake page does not establish authentication success. Use Microsoft 365 and other SaaS audit records to investigate subsequent email or document access and configuration changes. Passing through Teams does not itself establish tenant compromise.
• Follow-on Activity: Verify subsequent email or document access and configuration changes through audit records. Published counts of successful theft are unavailable.
• Containment: Remove the malicious email and restrict external URLs or resources confirmed as malicious. If credentials were exposed, change them and revoke affected sessions. Adopt phishing-resistant authentication such as FIDO2 or passkeys.
• Classification: Distinguish contact, execution, abuse of privileges, data collection, and follow-on compromise using evidence. Missing logs do not prove that compromise did not occur.

11. Defense and Detection Ideas

Inference: Operational recommendations based on the described behavior.

• Single Event: A DocuSign-themed email leads through Microsoft services to external content and an unexpected login interface.
• Time-Series Correlation: Trace message ID, OAuth/Teams redirects, external retrieval, browser display and input, and subsequent sign-ins.
• Threat Hunting: Where browser telemetry is available, investigate blob-based authentication interfaces appearing after external retrieval and associated service-worker behavior. Blob URLs and service workers are not malicious by themselves.
• Logging Gaps: Preserve browser history, screenshots or DOM, scripts, and service-worker registrations where available. Ordinary EDR does not necessarily record all of these. Use connections to delivery and control infrastructure as supporting evidence. Distinguish network destinations from URLs generated inside the browser.
• Priority Controls: Analyze the full click path, including the invitation and external resources. Use available browser records to investigate login interfaces displayed through blob URLs and related service-worker activity. Deploy phishing-resistant authentication such as FIDO2 security keys and passkeys.

12. Facts / Inference / Hypothesis

Facts

• Barracuda analyzed a campaign displaying its final phishing interface from a blob URL inside the browser. External retrieval and control traffic remain part of the chain.
• The DocuSign-themed email includes a calendar invitation and routes users through Microsoft OAuth and Teams.
• Teams loads a resource from cdn.bloom[.]io, and the browser displays the phishing content locally using a blob URL.
• Barracuda describes service workers, sandboxed iframes, and backend instructions controlling navigation. The public article does not establish registration origins or control scopes.

Inference

• The investigation, success-assessment, and defense recommendations are derived from public information. They are not observations of real-world compromise.

Hypothesis

No additional hypotheses. Unresolved points are listed under Unknowns and Further Investigation.

13. MITRE ATT&CK Mapping

• T1566.002 Phishing: Spearphishing Link (high confidence): A DocuSign-themed email and calendar invitation lead users to the phishing flow.
• T1056.003 Input Capture: Web Portal Capture (medium confidence): The browser-generated interface seeks credential input.

14. Unknowns and Further Investigation

• Victim counts, successful credential-theft counts, and operators.
• The final credential destination and complete C2 infrastructure.
• The service-worker script URL, registration origin, scope, and precise relationship to the iframe.

15. Impact on SOCs and Organizations

Treating a blob URL as an ordinary network domain to block will not capture a page generated inside the browser. Correlate email, Microsoft redirects, external retrieval, browser display, and subsequent identity activity. Combine investigation of delivery and control infrastructure with phishing-resistant authentication, without treating every use of a blob URL as malicious.

16. Audience Summaries

• SOC: Trace message ID, OAuth/Teams redirects, external retrieval, browser display and input, and subsequent sign-ins.
• Administrators: Remove the malicious email and restrict external URLs or resources confirmed as malicious. If credentials were exposed, change them and revoke affected sessions. Adopt phishing-resistant authentication such as FIDO2 or passkeys.
• Users: Verify unexpected signature requests through a separate channel. Do not rush to enter credentials merely because Microsoft’s name appears in the navigation.