SECURITYWEEK reports a novel phishing campaign that defeats traditional page-based defences by rendering the malicious page inside the victim’s browser using blob URLs. The operation starts with a Docusign-themed email that includes a calendar invite to appear legitimate. A crafted redirect then takes the user to Microsoft Teams, which loads an external resource hosted on cdn.bloom[.]io.
That resource is converted by the browser into a blob URL, which renders the phishing page entirely within the victim’s browser, leaving no static site for defenders to block.
Barracuda’s analysis shows that the phishing flow is managed by service workers, iframes and backend controls, with a hidden command-and-control configuration that indicates a centrally operated platform capable of updating and steering pages across multiple victims. Because the page exists only in-browser, there is no conventional page to block and scanners may miss the trigger.
The researchers suggest that future detection should focus on identity protection, browser security and behavioural signals, including closer scrutiny of blob URL activity, OAuth flows to suspicious destinations, and security controls that analyse the full click path rather than the initial URL. The article emphasises that this technique represents a shift away from detectable external pages and highlights the need for defensive measures that monitor browser behaviour and trusted-channel redirections.