On 2026-09-09, Barracuda Networks Associate Threat Analyst Ashitosh Deshnur published research describing a phishing campaign that begins with a DocuSign-themed email carrying a calendar invite (.ics) attachment. The invite itself is not malicious; it embeds a crafted redirect parameter that points to a genuine Microsoft OAuth endpoint (login.microsoftonline.com), giving the message the appearance of a routine business meeting request rather than an obvious phishing lure.

From the legitimate OAuth endpoint, the crafted redirect routes the victim through Microsoft Teams, which is made to load an external resource hosted on cdn.bloom[.]io. The victim's browser converts this externally sourced content into a blob URL -- a temporary, browser-generated address that points to data held only in local memory rather than on a remote server. The fake Microsoft login page is assembled and rendered entirely from this in-memory blob object inside the victim's own browser session, so no static phishing webpage ever exists for a security tool to crawl, fingerprint, or add to a blocklist.

Once rendered, the page registers a service worker and runs its logic inside a sandboxed iframe; together these manage the phishing workflow and user navigation. Barracuda's analysis states the phishing page 'receives instructions from backend infrastructure using browser messaging mechanisms,' which lets the attacker push live updates to the page's content and behavior after it has already loaded, instead of relying on a hardcoded redirect chain that a defender could map and block in advance.

Because every step -- the OAuth endpoint, the Teams content loader, and the final rendering surface -- takes place inside domains and browser behaviors that are either genuinely Microsoft-owned or exist only transiently in the victim's memory, the technique removes most of the static indicators (a persistent phishing domain, a fixed URL, a stable HTML artifact) that automated detection and blocklisting traditionally depend on. Barracuda characterizes this as phishing evolving 'beyond fake websites and suspicious domains,' reframing the credential-theft page as an ephemeral, dynamically-controlled browser construct instead of a hosted asset. Coverage was syndicated within 24 hours by SecurityWeek, Help Net Security, and several trade/MSP-focused outlets, extending visibility of the technique to a broad enterprise-security and SMB audience. No CVE applies -- this is an abuse of legitimate OAuth/Teams redirect and browser platform behavior (blob URLs, service workers, iframes, postMessage), not a software vulnerability. No malware hash, second-stage payload, actor name, or targeted-sector/region breakdown was disclosed in any of the reviewed sources; a BeaconBeagle lookup on cdn.bloom.io returned zero indexed C2 correlations.

Barracuda's writeup also discloses that the page carries a 'hidden command-and-control configuration' and states the operation is 'not a simple stand-alone [page], but part of a managed platform' that can be centrally operated, updated, and steered across many victims at once -- i.e., the campaign is consistent with a phishing-as-a-service (PhaaS) delivery model rather than a one-off, hand-built kit, though no branded kit name was disclosed and follow-up searches confirm this is a distinct campaign from named kits such as LogoKit or Sneaky 2FA. Every observable behavior in the chain -- constructing the Blob object from the fetched cdn.bloom[.]io resource, registering the service worker, executing logic inside the sandboxed iframe, and handling the browser-messaging instructions from the backend -- is implemented and driven by JavaScript running client-side in the victim's browser session; Barracuda's own framing of the core defensive gap is blunt: 'There is no phishing page to block.' Analyst Ashitosh Deshnur is quoted across the syndicated coverage: 'This campaign demonstrates how phishing is evolving beyond fake websites and suspicious domains, removing many of the indicators that security teams have traditionally relied on for detection.'