Almost every phishing defense a business runs assumes one thing: that there is a malicious page somewhere, sitting on a server, with a web address. Email filters follow the link and fetch it. Reputation services score the domain. Blocklists collect the URL so the next person is protected. The entire model depends on there being a page to find.
A campaign that Barracuda's threat researchers just documented removes the page. Not the phishing, the page. Instead of hosting a fake Microsoft login somewhere and sending you a link to it, the attack routes you through real Microsoft services and then assembles the phishing page inside your own browser, in memory, using a blob URL. There is no hosted site to retrieve, no domain to score, and no persistent URL to add to a blocklist. As Barracuda puts it, the page may never exist anywhere except in the victim's browser.
For anyone running Microsoft 365, this is worth understanding, because it quietly defeats the layer most organizations lean on hardest, and it points to the one place the attack can still be caught.
Key takeaways
Researchers at Barracuda documented a phishing campaign that builds the fake login page inside the victim's browser using a blob URL, a temporary address that points to content held in local memory rather than on a website (source).
The victim is routed through legitimate Microsoft services, including Microsoft OAuth and Microsoft Teams, so the visible navigation stays inside trusted domains and looks routine.
Because there is no hosted phishing page and no persistent URL, there is nothing for URL reputation, blocklists, or link-following email filters to retrieve, analyze, or block in advance.
A service worker and a sandboxed iframe let a backend steer the phishing experience live, so it behaves like a centrally-operated platform rather than a static page.
When there is no URL to inspect, the rendered page itself is the only place the attack becomes visible. That is the layer Haven works in.
Keep your business safe from online threats
Haven for Business protects every employee from phishing, fake sites, and browser-based attacks.
How the attack works
The chain is built to look ordinary at every visible step, which is the point.
It starts with a DocuSign-themed email, the kind of document-signing request that lands in business inboxes constantly. Attached is a calendar invite file. The invite is not the payload, and it is not obviously malicious, because it points to a genuine Microsoft OAuth endpoint. It is there to make the message look like a routine meeting or signing request, and to reduce the recipient's guard.
From there, a crafted redirect parameter sends the victim to Microsoft Teams. This matters: the addresses the victim passes through are real Microsoft properties, login.microsoftonline.com and Teams, so nothing in the visible navigation looks wrong. Teams then loads an external resource hosted on a content-delivery domain, cdn.bloom[.]io. The victim's browser takes that content and converts it into a blob URL, a temporary, browser-generated address that refers to data sitting in the browser's own memory. That blob URL renders the phishing page locally, right there in the session.
At that point the page is not just a static form. It registers a service worker, a script that can sit between the browser and the network and manage requests, and it runs part of its logic inside a sandboxed iframe. A hidden command-and-control configuration lets the attacker's backend send the page live instructions through browser messaging, which means the operators can change what the victim sees and where the workflow goes in real time. Barracuda notes this is not a lone page but part of a managed phishing platform that can be operated and steered across many victims at once.
The result is a credential-harvesting Microsoft login that arrived through trusted infrastructure, exists only inside the browser, and is controlled remotely, with almost none of the indicators the industry has spent two decades learning to detect.
Why this defeats the defenses most businesses rely on
It helps to be specific about which controls this walks past, because it is most of them.
URL and domain reputation cannot help, because the malicious content never has a stable web address to score. Blocklists cannot help, because there is no persistent phishing URL to collect and distribute. Link-following email filters that fetch the destination and judge it see legitimate Microsoft endpoints, because that is genuinely where the early links point. Even a careful employee checking the address bar sees trusted Microsoft domains through the part of the journey they are watching. Every one of these defenses operates before the page, on the link, the domain, or the sender, and this campaign has been built so that everything before the page looks clean.
This is the same pattern we described when attackers chained trusted Google services to slip a link past gateways, in the phishing link your filters are built to trust. The blob-URL technique takes it a step further. There, the link was engineered to survive inspection. Here, there is no page-level URL to inspect at all. And it is another confirmation of the argument we made in please stop telling people to look for spelling mistakes: the visible tells people are trained to notice have been engineered out, and the sign-in flow the victim is being walked through is, for most of its length, genuinely Microsoft's.
Barracuda's own conclusion is the important one, and it is worth stating plainly: the answer is to stop relying on blocking known phishing URLs and to move toward behavioral and browser-level detection, because the challenge is no longer spotting a malicious website. In this campaign, there may not be one.
Where this can actually be caught
If the link is clean, the domains are Microsoft's, and there is no hosted page to fetch, then the first moment the attack is actually itself, a fake Microsoft login asking for credentials, is when it renders in the browser. That is the only place left to catch it, and it is the layer Haven works in.
Haven is a browser extension that checks whether a page truly is who it claims to be, rather than trusting how the user arrived or how legitimate the path looked. It does not depend on a URL's reputation, a domain blocklist, or a hosted page it can fetch in advance, which is exactly what this campaign removes. When a credential-harvesting Microsoft login renders in front of your employee, Haven's job is to judge the page in front of them and flag it as an impersonated login before they enter anything, regardless of the trusted redirects that led there.
We should be precise about scope, because that is how this brand earns trust. Haven is not an email gateway, so it does not stop the DocuSign email or the calendar invite that begins the chain, and it does not monitor OAuth authorization flows on the server side. Its role is the last step, the rendered page and the moment of credential entry, which is precisely the step this attack cannot hide, because at some point it has to show the victim a fake login and ask them to use it. Haven is a complement to the identity controls Barracuda also recommends, especially phishing-resistant MFA such as FIDO2 security keys and passkeys, not a replacement for them. The strongest posture pairs phishing-resistant MFA with a browser-level check that catches the fake page at the point of entry, so that even if a credential is about to be typed, something is looking at what the page actually is.
For teams, this is squarely a Microsoft 365 problem, and it operates at the level of every employee's browser. Haven for Business extends this browser-level check across the organization, which is where a campaign like this, aimed at corporate Microsoft logins and delivered through Teams and OAuth, actually lands. We have written before about why Microsoft 365 phishing keeps beating login-time defenses in a phishing service that beat MFA at 258 companies, and about why the browser is now the control point that matters in the browser is the new OS, secure it like one.
The uncomfortable lesson underneath this campaign is simple. You can no longer count on there being a bad URL to block, a bad domain to score, or a visible tell to train against. Attackers have moved the phishing page to the one place your perimeter tools cannot reach and your user cannot easily judge: inside the browser, in the moment. That is the place it has to be caught.
About Haven
Haven is a browser extension that helps people make safer trust decisions online, before a scam can cost anything. It works at the moment someone is about to click a link or enter a password, flagging fake and impersonated login pages, suspicious links, and look-alike sites, and pausing risky downloads. Rather than only checking a page against a list of known-bad sites, Haven analyzes the actual page in front of the user, so it can catch brand-new and convincing fakes that other tools miss.
Haven is free for individual use. For teams, Haven for Business extends this browser-level protection across every employee. Haven is operated by MirrorTab, Inc.
