This phishing campaign uses a novel technique where attackers generate phishing pages inside the victim's browser using blob URLs derived from resources loaded via trusted Microsoft services. The attack begins with a crafted email that appears legitimate due to an attached calendar invite and a redirect through Microsoft Teams. The external resource hosted on cdn.bloom[.]io is converted by the browser into a blob URL that renders the phishing page locally, eliminating a static web page that security scanners can detect. The phishing page is managed through service workers, iframes, and backend controls, allowing centralized operation and updates across multiple victims. This approach improves stealth and flexibility compared to traditional phishing attacks relying on static malicious websites. Detection and mitigation require monitoring browser behaviors, OAuth flows, and full click paths rather than relying on URL or domain reputation.

The attack bypasses traditional phishing detection mechanisms that rely on identifying malicious URLs or static web pages by generating phishing content dynamically inside the victim's browser. This stealthy approach reduces the likelihood of detection by security scanners and email filters, increasing the risk of successful credential theft or other phishing outcomes. The centralized control of the phishing workflow allows attackers to manage multiple victims simultaneously, potentially increasing the scale and effectiveness of the campaign.

No official vendor advisory or patch information is provided. Mitigation should focus on enhanced detection techniques such as monitoring browser activity involving blob URLs, scrutinizing OAuth authorization flows for unexpected destinations, and employing email security controls that analyze the entire click path rather than just the initial URL. Identity protection and browser security measures should be emphasized. Traditional URL or domain blocking is ineffective against this technique due to the absence of static phishing pages.