Microsoft services exploited in new phishing campaign

Cybercriminals are deploying a sophisticated phishing campaign that avoids traditional websites to evade security filters. According to an analysis by Barracuda, attackers are utilizing legitimate Microsoft services, including OAuth authentication flows and Microsoft Teams, to build credible deceptive paths.

Instead of directing victims to a suspicious external domain that could be blacklisted, the fraudulent credential-stealing page is generated dynamically within the victim's browser using a blob URL. This temporary address exists only in the local session memory, making the attack harder for security systems to detect and block.