IOCs for phishing pages using blob URLs

Several active phishing campaigns use blob URLs to deliver their final pages. Rather than loading all malicious content over the network, the pages construct it dynamically in browser memory at runtime.

This delivery method can reduce the visibility available to network-based analyzers and complicate conventional URL inspection.

Read the full Unit 42 report and indicators →