Loading story…
A phishing campaign delivers DocuSign-themed emails with calendar-invite attachments and routes recipients through legitimate Microsoft OAuth and Microsoft Teams infrastructure before loading a credential-harvesting page from cdn.bloom[.]io. Rather than hosting a conventional phishing site, the campaign causes the victim’s browser to assemble the fake login interface as a blob: URL, leaving fewer static URLs and page artifacts for scanners to detect.
The operation appears to use a centrally managed phishing platform: the in-browser page registers a service worker, runs within a sandboxed iframe, and receives backend configuration and live instructions through browser messaging. Defenders should inspect complete email click paths and OAuth redirect chains, monitor blob-URL activity and anomalous service-worker registrations, and prioritize browser telemetry, behavioral controls, and phishing-resistant MFA.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Barracuda analyzed a phishing campaign that uses DocuSign-themed calendar invites, Microsoft OAuth and Teams redirects, and cdn.bloom[.]io to render credential-harvesting pages as blob URLs within victims’ browsers. The operation uses service workers, sandboxed iframes, and hidden command-and-control configuration, indicating a centrally managed phishing platform capable of dynamically directing victims.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
7 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourceitpro.com
Open sourcehelpnetsecurity.com
Open sourcecyberveille.ch
Open sourcesecurityweek.com
Open sourceblog.barracuda.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported a **Browser-in-the-Browser** phishing campaign targeting Microsoft 365 users with fake OAuth sign-in popups embedded inside malicious webpages. The attackers render the window with HTML, CSS, and JavaScript to mimic a legitimate browser authentication prompt, complete with a spoofed Microsoft URL, padlock icon, draggable behavior, and visual tailoring for Windows, macOS, Linux, Chrome, Firefox, Edge, and Safari. The credential-harvesting flow is delivered through a sandboxed iframe, separating the visible lure from the collection mechanism and making investigation more difficult. Researchers said the campaign uses multiple evasion techniques, including blocking debugging functions, fragmenting keywords and visible strings to bypass filters, and redirecting bots or scanners to a legitimate Microsoft Office help page. Victims who submit credentials can have their Microsoft 365 logins stolen, and attackers may also capture OAuth consent grants or session-like tokens that can preserve access to Microsoft 365 and connected cloud services even after a password reset. Unit 42 published domains linked to the activity and urged defenders to monitor for suspicious active sessions, revoke suspicious tokens, enforce conditional access for managed devices, and adopt phishing-resistant authentication such as **passkeys** or **FIDO2 hardware keys**.
Jun 29, 2026
A sophisticated, multi-stage phishing campaign has been observed targeting organizations globally to steal Microsoft 365 credentials. The operation, monitored since early November 2025, employs advanced evasion techniques such as nested PDFs, use of legitimate content delivery networks, and mouse tracking to bypass secure email gateways and multi-factor authentication. The final credential harvesting site is engineered to block security tools and analysts, and leverages legitimate Microsoft infrastructure to circumvent MFA, granting attackers immediate access to compromised accounts. These attacks highlight the increasing complexity of phishing operations and their ability to evade traditional security controls. In parallel, threat actors are exploiting free cloud hosting platforms like Cloudflare Pages to host convincing phishing portals impersonating banking and healthcare providers. These sites not only harvest credentials but also collect additional security information, such as answers to secret questions, and exfiltrate data via Telegram bots to evade detection. Attackers use compromised legitimate domains as redirectors, increasing the likelihood of bypassing spam filters and making takedown efforts more challenging. The convergence of advanced phishing techniques and abuse of trusted cloud services underscores the need for enhanced detection and response strategies for organizations relying on Microsoft 365 and similar platforms.
Jun 29, 2026
Attackers abused Microsoft’s legitimate authentication and Microsoft 365 infrastructure to run phishing and business email compromise campaigns without relying on fake login pages. Check Point observed more than 200 phishing emails sent to about 120 organizations across industries and countries, using Microsoft Planner-style notifications about HR, payroll, and benefits updates as lures. Victims were directed to a real `login.microsoftonline.com` authorization page and asked to approve a malicious OAuth application, after which Microsoft redirected the browser to an attacker-controlled AWS API Gateway endpoint that captured an authorization token for exchange into Microsoft account access. Researchers said the technique could give attackers broad access to Microsoft 365 data depending on granted permissions, including email, files, Teams chats, SharePoint, OneDrive, and calendar content, creating risks of credential theft, account takeover, data breaches, financial fraud, malware delivery, and BEC. High-value and privileged users, organizations handling sensitive data, tenants using Microsoft ADFS, and general Microsoft 365 users were identified as potential targets. Recommended defenses include enforcing MFA, auditing Microsoft 365 tenant and OAuth application settings, strengthening email and application security controls, applying sign-in risk policies, and training users to scrutinize consent prompts as well as phishing lures.
Aug 11, 2026