New Phishing Attack Creates Malicious Pages Inside the Victim’s Browser
Attackers are using Microsoft's own tools to create fake login pages that appear inside your browser, making them harder to spot or block. These pages look like real Microsoft sites but are actually traps to steal your credentials.
- Report priority
- Medium
How it works
- Attackers send victims a link that opens a fake Microsoft login page directly inside their browser.
- This page uses Microsoft's blob URLs (a way to host web content) to hide the real URL.
- When victims enter their credentials, the attacker captures them.
- The fake page looks like a real Microsoft site but has no separate website for defenders to block or detect.
What to do
If you clicked a link in an email or message that looked like it came from Microsoft and asked you to log in, check your browser's address bar for unusual URLs or missing Microsoft branding when logging in. These links often look like they go to Microsoft's login page but open a fake page inside your browser instead.
Never enter your Microsoft credentials on a page that doesn't look like the real Microsoft login site. If you suspect you clicked a fake link, go directly to Microsoft's official login page instead of using the link. If you entered your credentials, change your password immediately via Microsoft's official account security page and enable two-factor authentication.
Technical details
An attacker sends a victim an email with a link that looks like it goes to Microsoft's login page. When clicked, it opens a fake login page inside the victim's browser, using Microsoft's blob URLs to avoid detection. The victim enters their credentials, which are sent to the attacker instead of Microsoft.
Attackers are using trusted Microsoft services and blob URLs to generate stealthy phishing pages that leave defenders with no static website to detect or block.