Hackers Use Blob URLs and Microsoft Teams to Create Phishing Pages Inside Victims’ Browsers

Researchers observed a phishing campaign that leverages Microsoft OAuth redirects and Microsoft Teams to load attacker-supplied resources which the browser converts into blob URLs, rendering convincing fake sign-in pages locally to evade URL-based filters; the primary objective is credential theft and account takeover. The report describes the attack flow, browser features abused (blob URLs, service workers, sandboxed iframes), offers detection and mitigation guidance (inspect full click paths, preserve browser logs, adopt FIDO2/passkeys), and lists two defanged IoCs: cdn.bloom.io and login.microsoftonline.com.