Barracuda Research Finds Phishing Attack That Builds Fake Login Pages Inside The Victim’s Browser, Leaving No Trail For Security Tools

A phishing campaign is generating fake login pages directly inside victims’ browsers rather than hosting them on external web servers, making the attacks difficult for conventional security tools to detect or block.

Researchers at Barracuda have published an analysis of the campaign, which abuses legitimate Microsoft services to route victims through what appears to be trusted infrastructure before assembling a phishing page locally using blob URLs.

A blob URL is a temporary, browser-generated address that points to content stored in the device’s memory rather than on a website. Because the phishing page exists only within a specific browser session, there is no persistent URL for security tools to retrieve, analyse or add to a blocklist.

How The Attack Works

The campaign begins with a DocuSign-themed email that includes a calendar invitation file as an attachment. The calendar file is not malicious in itself but points to a legitimate Microsoft OAuth endpoint, helping the message appear to be routine business communication.

A crafted redirect parameter within the link routes the victim to Microsoft Teams, which then loads an external resource hosted on cdn.bloom[.]io. The browser converts that content into a blob URL, which renders the phishing page locally.

Once the page loads, it registers a service worker – a browser component that can manage network requests and page behaviour in the background. Part of the workflow also runs inside a sandboxed iframe, an isolated browser window embedded within the page.

Together, these elements control navigation, manage requests and coordinate the phishing experience without relying on a conventional phishing website.

Dynamic Control And Evasion

The phishing workflow receives instructions from backend infrastructure using browser messaging mechanisms. Because the attack is controlled dynamically rather than through hardcoded redirects, operators can modify destinations and behaviour in real time.

Hidden command-and-control configuration within the attack indicates it is not a standalone page but part of a managed phishing platform that can be centrally operated, updated and steered across many victims at once.

This gives attackers a level of flexibility not typically seen in static phishing pages, where content is fixed at the time of deployment.

Why Traditional Defences Fall Short

The architecture of the campaign is designed to reduce its visibility to both users and security tools at multiple points in the attack chain.

Because the visible navigation remains within trusted Microsoft services, including login.microsoftonline.com and Microsoft Teams, users and automated scanners may be less likely to flag the activity as suspicious. The phishing content is never served as a conventional webpage, so there is no hosted site for security teams to take down or blocklist.

Associate Threat Analyst at Barracuda, Ashitosh Deshnur (pictured), described the campaign as an example of how phishing is moving beyond fake websites and suspicious domains, removing many of the indicators that security teams have traditionally relied on for detection.

“Organisations should focus on identifying malicious behaviour and strengthening identity-based controls rather than simply blocking known phishing URLs,” Deshnur urged.

Recommended Defences

Barracuda’s researchers outlined several defensive measures for organisations looking to counter this type of attack.

These include monitoring OAuth authorisation flows and redirect chains for unusual or unexpected destinations, inspecting browser activity involving blob URLs when they are used to render login pages, and detecting suspicious service worker registrations associated with externally sourced content.

Organisations should also apply phishing-resistant multifactor authentication methods such as FIDO2 security keys and passkeys, and use email security controls that analyse the full click path rather than relying solely on the initial URL.

User training remains relevant too. Staff should be cautious of unexpected document-signing requests, even when links appear to use trusted Microsoft infrastructure.

As attackers increasingly move phishing workflows into the browser itself, the challenge for defenders is no longer limited to spotting a malicious website. In campaigns like this one, the phishing page may never exist anywhere except inside the victim’s browser.

Last Updated on September 10, 2026 by Nick Ross