Threat Actors Abuse Bubble Apps to Steal Microsoft Account Credentials
Summary
Kaspersky reports that attackers use Bubble apps hosted on *.bubble[.]io to evade phishing detection and direct users to fake Microsoft login pages, where entered credentials can be stolen.
Key points
- Kaspersky says attackers host phishing apps on Bubble’s *.bubble[.]io domain, which may be trusted by email security systems.
- The apps’ large JavaScript bundles and Shadow DOM structures can hinder automated analysis and conceal malicious behavior.
- The apps may redirect users to fake Microsoft login pages, sometimes hidden behind Cloudflare checks.
- Credentials entered on the pages may let attackers access Microsoft 365 email, calendars, and other sensitive account data.
- Researchers warn that phishing-as-a-service platforms and phishing kits may adopt no-code app builders for evasion.
- BleepingComputer said Bubble had not responded to its request for comment by publication time.
Article Details
- Event Type
- Phishing campaign abusing apps hosted on Bubble to target Microsoft accounts.
- Impact
- Credentials entered on fake Microsoft login pages are stolen. Attackers may use them to access email, calendars, and other sensitive data associated with Microsoft 365 accounts.
MITRE ATT&CK
Vendors
BubbleThreat actors are evading phishing detection by building and hosting malicious web apps on the no-code platform Bubble to target Microsoft accounts.MicrosoftThreat actors are evading phishing detection by building and hosting malicious web apps on the no-code platform Bubble to target Microsoft accounts.