Blob-Based Phishing: A New Breed of Browser-Only Attacks Flying Under the Radar
A newly discovered phishing tactic is reshaping how cybercriminals evade digital defenses. Instead of relying on traditional web-hosted traps, attackers are now embedding malicious content directly in the victim’s browser using blob URLs—a technique that renders many email filters and analysis tools ineffective.
Blob URLs (Binary Large Objects) are typically used to handle temporary data within a web browser. Threat actors have now weaponized this feature, crafting phishing pages that never touch a server or expose a traceable domain. These credential theft pages live exclusively in browser memory, vanishing the moment the tab is closed—and with them, most evidence.
What sets this method apart is how stealthy its delivery is. Victims receive emails that link to trusted, verified websites—nothing that would normally trigger spam or security alerts. But hidden in the journey through these sites is a detour: a chain of redirects culminating in a blob URL that spins up the phishing interface locally.
Because the malicious payload never exists on a conventional web server, tools that rely on scanning external URLs or analyzing domain reputation are blind to it. There’s no suspicious link to blacklist—just browser-generated code executing under the radar.
First spotted by researchers at Cofense in mid-2022, this approach is rapidly gaining popularity among threat actors. The technique’s effectiveness lies in its simplicity: no external infrastructure, no obvious digital breadcrumbs, and a phishing page that’s effectively invisible to traditional defenses.
This evolution in phishing underscores a critical need for behavioral detection, advanced sandboxing, and better awareness of client-side threats. In the age of blob-based deception, the browser itself has become both the battleground and the bait.
Attack Flow Overview (Original Research by Cofense)
This phishing campaign doesn’t rely on brute-force tactics—it’s engineered with precision across multiple steps. The sequence begins with a deceptive email that slips past Secure Email Gateways (SEGs) by avoiding obvious red flags. Rather than pointing users to known malicious domains, the message routes them through trusted platforms—often leveraging well-known services like Microsoft OneDrive—to maintain the illusion of legitimacy and avoid triggering suspicion.
Deceptive Detour: How Trusted Sites Are Used to Launch Browser-Based Phishing Payloads
(Insight courtesy of Cofense)
At first glance, the user lands on a familiar interface—OneDrive’s official domain, no less. It looks routine: a prompt to view a document or sign in. But behind the clean façade lies a strategic deception.
Instead of delivering a payload outright, the site acts as a launchpad. The moment a user clicks “Sign in” or attempts to access the file, the page quietly hands off control to a malicious HTML file. This file, operating entirely within the user’s browser, constructs a blob URL on the fly—activating the phishing sequence without ever calling a suspicious external site.
This approach doesn’t just hide the payload—it eliminates it from the network layer entirely, making the phishing page detectable only once it’s too late.
In-Browser Illusion: Blob-Based Pages Imitate OneDrive Login Screens
(Source: Cofense)
Once triggered, the attack culminates in a deceptive login interface generated entirely through a browser-based blob URI—typically displayed as something like blob:https://domain.com/unique-id. At a glance, it mirrors the look and feel of a genuine Microsoft 365 or OneDrive login, exploiting user familiarity and trust.
But beneath the surface, the page is more than just a visual trick. Though it exists only in temporary browser memory and never touches a traditional web server, it’s fully wired to capture and quietly transmit credentials to infrastructure under the attacker’s control.
What makes this tactic particularly dangerous is its ability to outmaneuver both automated defenses and human judgment. Users are trained to scrutinize URLs—but in this case, there is no suspicious domain to catch. The phishing payload lives inside the browser, invisible to conventional detection methods and immune to common best practices.
This marks a sharp shift in phishing strategy—away from malicious hosting and toward ephemeral, browser-native traps that operate entirely off the radar.
