New Phishing Attack Uses Blob URLs to Hide Malicious Pages From Security Scanners
A new phishing trick hides fake login pages inside your browser so security tools can't block them. Attackers send links that load a cloned login page only after you click, making it harder to spot.
- Report priority
- Medium
How it works
- Attackers send a link that looks like it points to a real login page.
- When you click it, your browser loads a fake login page from inside your own browser's memory, not from a hacked website.
- This lets the fake page avoid security filters and scanners that block known phishing sites.
What to do
If you clicked a suspicious link claiming to be from Microsoft, Google, or another service and saw a login page load inside your browser, check your browser's address bar: if the URL looks real but the page feels off, it could be fake. No software update fixes this, only spotting the trick works.
Technical details
A fake Microsoft login link appears in an email or chat. When clicked, it loads a cloned Microsoft login page inside your browser, tricking you into entering your real password. The page never touches an attacker's server, so security tools can't detect or block it.
This phishing campaign evades detection by dynamically generating malicious login pages directly in the victim's browser using Blob URLs, a web technology that creates temporary, in-memory web content. Instead of hosting a full phishing kit on attacker-controlled servers, where it could be blocked or taken down, the attack chain delivers only a minimal script that constructs the fake portal on the fly. This approach makes static analysis and URL-based filtering ineffective, as the actual malicious page never exists on a detectable domain until the victim interacts with it. The technique allows attackers to harvest credentials without relying on persistent infrastructure, reducing the risk of disruption by security tools.