Hackers Use Blob URLs and Microsoft Teams to Create Phishing Pages Inside Victims’ Browsers

A new phishing campaign is moving fake login pages into victims’ browsers. Rather than sending people to a malicious website, its operators use browser-generated blob URLs to assemble the page in local memory, leaving less for security tools to inspect before it appears. The operation starts with a DocuSign-themed email carrying a calendar...