Phishing Pages Built Inside Your Browser: How Attackers Are Using Microsoft's Own Tools Against You

Key points

• Attackers are using trusted Microsoft cloud services to host phishing content, making fake pages look indistinguishable from real ones.
• The technique uses blob URLs, temporary addresses that exist only inside a single browser tab and vanish the moment it closes.
• Because no external website is involved, traditional tools that scan URLs for known-bad addresses can't flag the attack.
• No specific threat group has been publicly tied to active exploitation at medium confidence or above.
• People targeted by this method face a login screen that looks completely genuine, with no obvious red flags in the address bar.

What is actually happening here?

Criminals are building fake login pages that never exist on the public internet. Instead of creating a fraudulent website that security tools could detect, they use Microsoft's own legitimate cloud services to deliver a small piece of code to the target's browser, which then assembles the fake page locally, on the victim's own machine.

The address bar shows a blob URL, a temporary web address a browser creates for itself when it needs to display something in memory. It looks like a string of random characters and never leaves the device. Defenders can't scan it, blocklist it or pass it to another team to action. The fake page disappears the instant the tab closes.

Why does using Microsoft's services matter?

Security filters trust Microsoft. Emails or links pointing to legitimate Microsoft infrastructure, such as OneDrive or Azure, routinely pass through spam filters and corporate firewalls without being stopped.

That's the point. Attackers aren't building shady websites. They're parking malicious code inside services that already have a clean reputation, then letting the victim's own browser do the rest.

This is a meaningful shift. Traditional phishing leaves a fixed address that defenders can find and block across every organisation. Blob-based phishing leaves nothing to share. Our 4 September story on the phishing gang hiding invisible characters inside emails shows the same underlying logic: make the payload invisible to scanners, not just to humans.

Should you worry?

Yes, though calmly. Ordinary users can't be expected to spot this through address-bar inspection alone.

Treat any unexpected login prompt with suspicion, regardless of how professional it looks. If an email pushes you toward a sign-in page you weren't expecting, stop. Go directly to the service's website by typing the address yourself.

If you entered credentials on a page you now doubt, change your password immediately and check your account's recent sign-in history for unfamiliar activity.

Organisations should ensure multi-factor authentication, which requires a second proof of identity beyond a password such as a code sent to your phone, is active for every account. A stolen password alone isn't enough to get in when MFA is enabled.

From an attribution standpoint, no specific group has been publicly tied to active exploitation at medium confidence or above. The method overlaps with tactics seen in browser-in-the-browser phishing campaigns tracked by multiple vendors, but capability isn't intent. Wider adoption by lower-tier criminals is plausible once techniques like this circulate.

Defenders are used to blocking places. This attack has no place to block.