Phishing detection has traditionally relied on finding a malicious destination. But what happens when the phishing page doesn't exist on the web at all? Recent research uncovered an attack campaign that uses a blob URL to create a credential-stealing page entirely inside the victim's browser.
What is a blob URL?
A blob URL is a temporary address created by a browser that points to data stored in its memory. In this attack, the phishing page never lives on a traditional web server. Instead, it exists only inside the victim's browser during that session. This makes it extremely difficult for traditional security tools to detect because there's no external URL or domain to blacklist.
How the attack works
The attacker sends a phishing email that includes a link. The link doesn't point directly to a phishing page. Instead, it leads to a legitimate web service that the attacker has compromised or abused. Once the victim clicks the link, the attacker uses browser features like blob URLs, service workers, and sandboxed iframes to create the phishing page dynamically inside the browser.
The page harvests credentials and sends them to the attacker without ever existing as a standalone website. This approach hides the phishing infrastructure and makes it harder to investigate.
What to watch for
Checking for misspelled URLs is no longer sufficient. Security teams need to monitor unusual activity across OAuth flows and redirect chains. Strong identity controls like FIDO2 security keys and passkeys can help prevent unauthorized access, even if credentials are stolen. Employees should be cautious of any unexpected request, even if it appears to come from a familiar service.
Retailers face unique challenges
Retailers are experiencing a unique challenge due to the use of text salting. According to the National Anti-Scam Centre’s Targeting Scams Report 2025, Australians reported 481,523 scams and $2.18 billion in losses last year. The retail sector is a prime target for these attacks, as they often exploit the trust consumers place in well-known brands.
Text salting is a phishing technique where attackers target the AI systems designed to detect malicious emails. By slightly altering the text in phishing emails, they can bypass detection and reach their targets. This method is particularly effective against retailers, as it can exploit the vast amount of customer data they manage, including payment information, personal details, and account credentials.
AI-generated content fuels phishing growth
AI-generated content has made it easier for cybercriminals to create sophisticated and convincing phishing campaigns. These tools can quickly produce personalized emails and websites that appear legitimate, increasing the chances of success. Retailers need to remain vigilant and invest in advanced cybersecurity measures to protect their customers and brand reputation. According to Barracuda researchers, over one million phishing attacks themed around retail were observed.
Why it matters
As phishing techniques evolve, security strategies must adapt. The shift from identifying suspicious URLs to understanding how attackers abuse legitimate services highlights the need for more sophisticated detection methods. Organizations should prioritize broader context analysis and stronger identity controls to protect against these emerging threats.