New Phishing Attack Leverages Azure Blob Storage to Impersonate Microsoft

**Executive Summary:** Threat actors are abusing Microsoft Azure Blob Storage to host highly convincing phishing pages that impersonate Office 365 sign-in portals, tricking users into submitting Microsoft 365 credentials; the campaign often begins with deceptive emails (e.g., Forms links) and redirects to HTML hosted under blob.core.windows.net, making the pages appear legitimate and SSL-secured. The report highlights indicators (blob.core.windows.net URLs), the risk of credential and tenant compromise, and recommends mitigations including blocking *.blob.core.windows.net except trusted accounts, enabling MFA, monitoring Microsoft Entra ID for anomalous logins, and applying custom tenant branding to help users identify genuine sign-ins.