Phishing Campaign Uses Microsoft OAuth and Teams to Build Fake Login Pages in Victims’ Browsers
Summary
Barracuda reports a phishing campaign that uses a DocuSign-themed email and genuine Microsoft OAuth and Teams infrastructure to load a fake login page assembled in victims’ browsers with a blob URL.
Key points
- The campaign starts with a DocuSign-themed email containing a calendar invite attachment.
- A crafted redirect routes victims through genuine Microsoft OAuth and Teams infrastructure.
- Teams loads an external resource from cdn[.]bloom[.]io, leading to a fake login page assembled locally using a blob URL.
- The page registers a service worker and uses a sandboxed iframe; hidden command-and-control configuration lets operators steer page content.
- Barracuda recommends phishing-resistant MFA, inspecting full link and redirect paths, and monitoring blob URL activity and service worker registrations.
Article Details
- Event Type
- Browser-based phishing campaign using Microsoft OAuth and Teams infrastructure
- Impact
- Victims are routed to a fake login page assembled locally in their browsers. Service workers, sandboxed iframes, and hidden command-and-control configuration allow operators to steer the page and make it harder to detect and block.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cdn[.]bloom[.]io | External domain loaded through Microsoft Teams; the article says its resource ultimately results in the phishing page being rendered in the victim's browser. |