New Phishing Attack Abusing Blob URLs to Bypass SEGs and Evade Analysis

Cybersecurity experts have identified a sophisticated phishing technique that exploits blob URIs (Uniform Resource Identifiers) to evade detection by Secure Email Gateways (SEGs) and security analysis tools. This emerging attack method leverages the unique properties of blob URIs, which are designed to display temporary data that can only be accessed by the browser that generated […] The post New Phishing Attack Abusing Blob URLs to Bypass SEGs and Evade Analysis appeared first on Cyber Security News.

May 12, 2025 - 09:02

New Phishing Attack Abusing Blob URLs to Bypass SEGs and Evade Analysis

Cybersecurity experts have identified a sophisticated phishing technique that exploits blob URIs (Uniform Resource Identifiers) to evade detection by Secure Email Gateways (SEGs) and security analysis tools.

This emerging attack method leverages the unique properties of blob URIs, which are designed to display temporary data that can only be accessed by the browser that generated it.

Unlike standard phishing sites that can be crawled and analyzed, blob URI-based attacks create credential harvesting pages that exist solely in the victim’s browser memory, making them nearly invisible to traditional security measures.

The attack begins with a seemingly innocuous email containing links to legitimate, allowlisted websites rather than directly to malicious domains.

This initial misdirection helps the phishing attempt bypass email security filters that typically block messages with suspicious links.

Upon reaching these intermediary pages, victims are then redirected through a series of steps that ultimately generate a local blob URI containing the actual phishing content.

Cofense researchers identified this technique starting in mid-2022 and have observed its growing adoption among threat actors.

According to their analysis, this method is particularly effective because the final credential phishing page exists only in the victim’s browser, leaving no external URL for security tools to scan or block.

This technical limitation creates a significant blind spot in conventional phishing detection systems.

The infection chain follows a sophisticated multi-stage process. After the initial email bypasses the SEG, users are directed to legitimate services such as Microsoft OneDrive.

Intermediary site before redirecting to the phishing site is onedrive[.]live[.]com (Source – Cofense)

What appears to be a standard login page or document access screen is actually a carefully crafted redirection mechanism.

When victims click to “Sign in” or “View document,” they are seamlessly directed to a threat actor-controlled HTML page that generates a blob URI locally in the victim’s browser.

A blob URI page spoofing a OneDrive login (Source – Cofense)

The resulting phishing page, rendered from the blob URI (typically appearing as “blob:https://domain.com/random-string” in the address bar), presents convincing login forms mimicking services like Microsoft 365 or OneDrive.

Despite existing only in the local browser memory, these pages contain hidden functionality to exfiltrate captured credentials to remote servers controlled by the attackers.

This technique represents a concerning evolution in phishing tactics, as it effectively circumvents both technological defenses and standard user awareness training that emphasizes checking URL validity before entering credentials.

Are you from the SOC and DFIR Teams? – Analyse Real time Malware Incidents with ANY.RUN -> Start Now for Free.

The post New Phishing Attack Abusing Blob URLs to Bypass SEGs and Evade Analysis appeared first on Cyber Security News.