Cybersecurity experts have identified a sophisticated phishing technique that exploits blob URIs (Uniform Resource Identifiers) to evade detection by Secure Email Gateways (SEGs) and security analysis tools. Unlike standard phishing sites that can be crawled and analyzed, blob URI-based attacks create credential harvesting pages that exist solely in the victim’s browser memory, making them nearly invisible to traditional security measures. According to their analysis, this method is particularly effective because the final credential phishing page exists only in the victim’s browser, leaving no external URL for security tools to scan or block. The resulting phishing page, rendered from the blob URI (typically appearing as “blob: ; in the address bar), presents convincing login forms mimicking services like Microsoft 365 or OneDrive. When victims click to “Sign in” or “View document,” they are seamlessly directed to a threat actor-controlled HTML page that generates a blob URI locally in the victim’s browser. This initial misdirection helps the phishing attempt bypass email security filters that typically block messages with suspicious links. Upon reaching these intermediary pages, victims are then redirected through a series of steps that ultimately generate a local blob URI containing the actual phishing content. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. This technique represents a concerning evolution in phishing tactics, as it effectively circumvents both technological defenses and standard user awareness training that emphasizes checking URL validity before entering credentials. This emerging attack method leverages the unique properties of blob URIs, which are designed to display temporary data that can only be accessed by the browser that generated it. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 12 May 2025 07:40:20 +0000