ITPro (10 September 2026) reports Barracuda research on an email phishing campaign that generates the phishing page directly inside the victim's browser instead of on a phishing website. The attack begins with a DocuSign-themed email with a calendar invite attached that points to a legitimate Microsoft OAuth endpoint; a crafted redirect routes the user to Microsoft Teams, which loads an external resource hosted on cdn.bloom[.]io, and the browser converts this content into a blob URL — a temporary address pointing to content held in local memory — that renders the phishing page locally.

The page registers a service worker, part of the workflow runs in a sandboxed iframe, and the workflow receives instructions from backend infrastructure through browser messaging, so operators can change destinations and behaviour in real time.

Barracuda warned there is no phishing page to block and no persistent phishing URL for security tools to retrieve, analyse or blocklist in advance.

Treat as an advisory on technique, not a named AU incident. (source: ITPro, citing Barracuda)

Correction (31 Oct 2026): replaced SecurityWeek, which this desk cannot read, with ITPro as the card's source, removed a detail that only SecurityWeek gave, and moved the card date from 9 to 10 September 2026, the date of ITPro's report. (source: ITPro)