Phishing Campaign Uses Microsoft OAuth and Teams to Deploy Browser‑Based Login Scam

A new phishing campaign is using legitimate Microsoft OAuth and Teams infrastructure to route victims into a fake login page that is built entirely inside their own browser, according to researchers at Barracuda.

Instead of hosting a phishing site on a remote server, attackers assemble the malicious content inside the victim's browser using a blob URL, a temporary browser-generated address that points to content stored locally in memory. This removes many of the traditional indicators security teams rely on, such as suspicious domains or external hosting.

The attack begins with a DocuSign-themed email containing a calendar invite. The invite itself is not malicious. Its purpose is to make the message appear like a routine meeting request, and the tactic works because the link points to a genuine Microsoft OAuth endpoint rather than an obviously fraudulent destination.

A crafted redirect parameter then sends the victim to Microsoft Teams. Teams loads a resource from an external domain, cdn.bloom.io, which ultimately causes the phishing page to be rendered from a blob URL directly on the victim's machine. Once loaded, the page registers a service worker and runs part of its logic inside a sandboxed iframe.

These components allow the attacker's backend to send live instructions to the page through browser messaging. Operators can change what the victim sees without relying on hardcoded redirects, making the phishing flow dynamic and centrally controlled. Hidden command-and-control configuration shows the page is part of a managed phishing platform capable of steering multiple victims at once.

Barracuda advises organizations to monitor OAuth authorization flows and redirect chains for unexpected destinations, inspect blob URL activity during login or authentication, and flag service worker registrations tied to externally loaded content. The company also recommends phishing-resistant MFA such as FIDO2 keys or passkeys, email security tools that follow a link's entire path, and training staff to question document-signing requests even when they appear to run through trusted Microsoft infrastructure.

"This campaign demonstrates how phishing is evolving beyond fake websites and suspicious domains, removing many of the indicators that security teams have traditionally relied on for detection," said Ashitosh Deshnur, Associate Threat Analyst at Barracuda. He added that organizations should focus on identifying malicious behavior and strengthening identity-based controls rather than simply blocking known phishing URLs.