New BlobPhish Attack Leverages Browser Blob Objects to Steal Users’ Login Credentials

BlobPhish is a long-running (first observed October 2024) memory-resident credential-phishing campaign that builds phishing pages inside victims' browsers using JavaScript Blob URLs to avoid network, proxy, and file-based detection; it targets Microsoft 365 and major U.S. banks and financial platforms, uses loader pages and WordPress-compromised exfil endpoints, includes multiple IOCs and code-level TTP details, and provides defensive recommendations including sandboxing, threat hunting, and phishing-resistant MFA.