Hackers Use Blob URLs and Microsoft Teams to Create Phishing Pages Inside Victims’ Browsers

Attackers use Blob URLs and Microsoft Teams to host phishing pages directly in victims' browsers, evading detection. Campaigns begin with DocuSign-themed emails containing malicious calendar invitations that redirect through Microsoft OAuth and Teams endpoints, making the attack appear legitimate while bypassing security inspections.

https://cybersecuritynews.com/hackers-use-blob-urls/