A new credential-theft campaign is assembling its fake login page inside the victim’s browser rather than serving the finished page from an ordinary malicious website. The operators combine DocuSign-themed messages, Microsoft infrastructure and blob URLs to make the journey appear familiar while limiting the conventional web content that security scanners can inspect in advance.

Barracuda researchers identified the activity, according to Cyber Security News. The lure begins with an email containing a calendar invitation that presents itself as a document request. A link passes through a Microsoft OAuth endpoint and then a crafted redirect into Microsoft Teams before harmful code creates the phishing interface locally in the browser.

How the redirect chain builds trust

Each element of the chain is chosen to reduce suspicion. DocuSign is associated with urgent business approvals, calendar invitations fit normal office workflows and Microsoft domains are widely trusted. A recipient may therefore focus on the apparent document task instead of examining why several services are involved.

The campaign is not exploiting a vulnerability in Teams. It is abusing legitimate routing and collaboration features as part of social engineering. This distinction matters for defenders: simply patching the Teams client does not remove the risk, because the attack succeeds by persuading a user to follow a deceptive sequence and surrender credentials.

Why blob URLs complicate inspection

A blob URL points to data held by the browser, often created by JavaScript during a session. Legitimate applications use blobs for downloads, media and dynamically generated content. In this attack, the mechanism lets the browser construct the fake sign-in page in memory instead of loading a complete phishing site from a remote server.

That design can leave email and URL scanners with less malicious page content to retrieve during pre-delivery analysis. A gateway may see trusted redirects and an intermediate resource, while the convincing login interface emerges only after code runs in the user’s session. Blob addresses also look unusual and temporary, making conventional domain reputation less directly useful at the final stage.

The objective is account takeover

The page aims to collect sign-in details. Once attackers obtain working credentials, they may access email, cloud files or collaboration tools and use the compromised identity to send more convincing messages. If the account lacks phishing-resistant multifactor authentication, a password and captured verification flow may be enough to establish a session.

Compromised business accounts are valuable because their normal communication history and trusted relationships improve later lures. An attacker can search mailboxes for invoices, contracts and active projects, then insert a fraudulent request into a genuine conversation. The initial browser trick can therefore become the opening step in a larger business email compromise.

Controls that reduce exposure

• Train users to verify unexpected signature requests through a separate, known channel.
• Inspect calendar invitations and collaboration links with the same caution applied to email attachments.
• Use phishing-resistant authentication such as FIDO2 security keys or properly deployed passkeys.
• Monitor unusual OAuth, Teams and identity-provider redirects across security telemetry.
• Alert on new sign-in locations, impossible travel, unfamiliar devices and suspicious mailbox rules.

Web controls can also examine script behavior and redirect chains at click time, when more context is available than during initial email scanning. Endpoint and browser telemetry may show the creation of a blob-based document followed by credential submission. No single indicator is decisive, but correlated events can expose the sequence.

Responding to suspected interaction

If a user entered credentials, responders should reset the password, revoke active sessions and review newly registered authentication methods. They should inspect mailbox forwarding, inbox rules, OAuth grants and recent cloud-file access. Merely changing the password may leave an existing token or attacker-added sign-in method usable.

The campaign illustrates how phishing pages are becoming less dependent on obviously hostile domains. Defenders need visibility across email, browsers, identity systems and collaboration platforms, while users need a simple reporting path for suspicious document requests. Trusted services can form part of an untrusted journey, so the full sequence matters more than the reputation of any single link.