Bubble AI app builder abused to steal Microsoft account credentials

Kaspersky and reporting show threat actors are using Bubble’s legitimate no-code app hosting to serve heavily obfuscated Microsoft-themed phishing pages on trusted *.bubble.io domains, allowing credential harvesting and evasion of email security; researchers warn this tactic — which leverages complex JavaScript and Shadow DOM to hide redirection and data exfiltration — is likely to be integrated into phishing-as-a-service kits and increase the stealth and scale of account takeover campaigns.