Phishing Moves Inside the Browser

A new phishing technique is generating malicious pages directly inside victims’ browsers, potentially bypassing conventional URL-based security controls. Instead of hosting phishing websites, attackers use temporary browser-generated blob URLs.

Victims are routed through legitimate Microsoft services, including Microsoft login infrastructure and Teams. This makes the attack chain appear more trustworthy and reduces familiar warning signs.

Because the malicious page exists only within a specific browser session, there may be no persistent phishing URL for security tools to retrieve, analyze or blocklist.

The attack also uses service workers, sandboxed iframes and browser messaging mechanisms to control navigation and dynamically manage malicious activity.

Barracuda warns that phishing is moving beyond fake domains and websites, weakening traditional detection methods that depend heavily on suspicious URLs and known infrastructure.

Organizations therefore need behavior-based detection, stronger identity protection and phishing-resistant MFA, alongside monitoring of blob URLs, OAuth redirects, service-worker registrations and complete user click paths.