Barracuda Details Phishing Campaign That Builds Pages Inside Victims’ Browsers
Summary
Barracuda researchers describe a phishing campaign that routes victims through Microsoft services, then builds the phishing page locally with a blob URL. Service workers, sandboxed iframes and backend controls manage the workflow.
Key points
- The campaign begins with a DocuSign-themed email carrying a calendar invitation attachment that points to a legitimate Microsoft OAuth endpoint.
- A crafted redirect routes victims through Microsoft Teams, which loads an external resource from cdn.bloom[.]io.
- The browser converts the resource into a blob URL, rendering the phishing page locally rather than serving it from a conventional phishing website.
- A service worker and sandboxed iframe help manage requests, navigation and the phishing workflow.
- Backend infrastructure can dynamically control destinations and behavior; Barracuda says hidden command-and-control configuration indicates a centrally managed platform.
- Barracuda recommends monitoring OAuth flows and redirects, blob URL activity and suspicious service worker registrations, alongside phishing-resistant MFA and email click-path analysis.
Article Details
- Attack Vectors
- A DocuSign-themed email includes a calendar invitation attachment that routes the victim through a Microsoft OAuth redirect to Microsoft Teams.
- Microsoft Teams loads an external resource from cdn.bloom[.]io, which is converted into a browser-local blob URL that renders the phishing page.
- The phishing workflow uses a service worker, a sandboxed iframe, browser messaging, and backend controls to manage navigation and dynamically steer victims.
- Defensive Notes
- Monitor OAuth authorization flows and redirect chains for unusual or unexpected destinations.
- Inspect browser activity involving blob URLs, especially when they render login or authentication pages.
- Detect suspicious service-worker registrations associated with externally sourced content.
- Use phishing-resistant MFA methods such as FIDO2 security keys and passkeys.
- Analyze the full email click path, and train users to be cautious of unexpected document-signing requests even when links use trusted Microsoft infrastructure.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cdn[.]bloom[.]io | External resource host used in the reported phishing attack to deliver content that is rendered as a browser-local phishing page. |