Phishing Pages Built Inside Your Browser: How Attackers Are Using Microsoft's Own Tools Against You

Key points

• Attackers are using trusted Microsoft cloud services to host phishing content, making fake pages look indistinguishable from real ones.
• The technique uses "blob URLs," which are temporary addresses that exist only inside a single browser tab and vanish the moment it closes.
• Because no external website is involved, traditional tools that scan URLs for known-bad addresses cannot flag the attack.
• Security researchers first reported this technique at SecurityWeek.
• People targeted by this method face a login screen that looks completely genuine, with no obvious red flags in the address bar.

What is actually happening here?

Criminals are building fake login pages that never exist on the public internet. Instead of creating a fraudulent website that security tools could detect, they use Microsoft's own legitimate cloud services to deliver a small piece of code to the target's browser, which then assembles the fake page locally, meaning on the victim's own computer.

The address bar shows a "blob URL," a temporary web address that a browser creates for itself when it needs to display something in memory. It looks like a string of random characters. It never leaves the device. It cannot be scanned, blocklisted, or reported.

The fake page disappears the instant the tab closes.

Why does using Microsoft's services matter?

Security filters trust Microsoft. Emails or links pointing to legitimate Microsoft infrastructure, such as OneDrive or Azure cloud storage, routinely pass through spam filters and corporate firewalls without being stopped.

That is the point. Attackers are not building shady websites. They are parking their malicious code inside services that already have a clean reputation, then letting the victim's own browser do the rest.

This is a meaningful shift. Traditional phishing, where criminals send fake emails containing a link to a fraudulent website, leaves a fixed address that defenders can identify, share, and block across every organisation. Blob-based phishing leaves nothing to share.

Should people be worried?

Yes, though calmly. This technique is sophisticated, and ordinary users cannot be expected to spot it through address-bar inspection alone.

What people can do is treat any unexpected login prompt with suspicion, regardless of how professional it looks. If an email or message pushes you toward a sign-in page you were not expecting, stop. Go directly to the service's website by typing the address yourself, rather than clicking through.

If you entered credentials on a page you now doubt, change your password immediately and, if available, check your account's recent sign-in history for unfamiliar activity.

Organisations using Microsoft 365 should ensure multi-factor authentication, which requires a second proof of identity beyond a password such as a code sent to your phone, is enabled for every account. A stolen password alone is not enough to get in if MFA is active.

From an attribution standpoint, no specific group has been publicly tied to active exploitation of this technique at medium confidence or above. The method overlaps with tactics seen in browser-in-the-browser phishing campaigns associated with clusters tracked by multiple vendors, but capability is not intent. Wide adoption by lower-tier criminals is plausible once techniques like this circulate.

The core problem remains: defenders are used to blocking places. This attack has no place to block.