Phishing Attack Exploits Blob URLs to Evade Email Security and Detection Systems

Cofense Intelligence observed a phishing tactic that leverages browser-generated blob URIs to render phishing credential pages locally in victims' browsers. Attackers use trusted platforms as intermediaries to evade email filters, then serve scripts that create ephemeral blob:http(s) pages containing credential capture forms; because these pages live only in browser memory, they frustrate URL-based detection and forensic retrieval, enabling stealthy exfiltration of user credentials.