New Phishing Attack Creates Malicious Pages Inside the Victim’s Browser
Source SecurityWeek
Description
A new phishing attack technique uses trusted Microsoft services and blob URLs to create phishing pages that exist only inside the victim's browser, leaving no static web page for defenders to detect or block. The attack starts with a Docusign-themed email containing a calendar invite to appear legitimate. The victim is redirected through Microsoft Teams to an external resource, which the browser converts into a blob URL rendering the phishing page locally. This method leverages trusted assets to evade traditional detection methods and enables centralized control of the phishing workflow. Detection requires new approaches focusing on browser activity and identity protection rather than static URL or domain blocking.
Impact
The attack bypasses traditional phishing detection mechanisms that rely on identifying malicious URLs or static web pages by generating phishing content dynamically inside the victim's browser. This stealthy approach reduces the likelihood of detection by security scanners and email filters, increasing the risk of successful credential theft or other phishing outcomes. The centralized control of the phishing workflow allows attackers to manage multiple victims simultaneously, potentially increasing the scale and effectiveness of the campaign.
Defensive guidance
No official vendor advisory or patch information is provided. Mitigation should focus on enhanced detection techniques such as monitoring browser activity involving blob URLs, scrutinizing OAuth authorization flows for unexpected destinations, and employing email security controls that analyze the entire click path rather than just the initial URL. Identity protection and browser security measures should be emphasized. Traditional URL or domain blocking is ineffective against this technique due to the absence of static phishing pages.