India, Sept. 22 -- Browser-based phishing is changing the familiar phishing playbook. Instead of sending victims to a conventional malicious website, attackers can now generate the phishing page directly inside the browser using blob URLs.

Barracuda researchers found a campaign that uses this approach while routing victims through legitimate Microsoft services, including Microsoft Teams and login.microsoftonline.com. That combination removes several warning signs that security teams and users often rely on when identifying suspicious emails.

Blob URL phishing removes the usual webpage The key difference is that there may be no traditional phishing website to block. The malicious content exists within a specific browser session, meaning ...