New Phishing Attack Leverages Azure Blob Storage to Impersonate Microsoft
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Threat actors are leveraging Microsoft Azure Blob Storage to craft highly convincing phishing sites<\/a> that mimic legitimate Office 365 login portals, putting Microsoft 365 users at severe risk of credential theft.<\/p>\n This method exploits trusted Microsoft infrastructure, making the attacks harder to spot as the fraudulent pages appear secured by official SSL certificates issued by Microsoft itself.<\/p>\n ALI TAJRAN recently highlighted a surge in these campaigns, with alerts circulating widely on October 17, 2025, urging immediate vigilance among enterprises and individuals.\u200b<\/p>\n The phishing scheme typically begins with deceptive emails that include links disguised as routine Microsoft Forms surveys<\/a> or document shares, often starting with URLs like forms.office[.]com followed by a unique identifier.<\/p>\n Victims who click these links are redirected to what seems like a harmless PDF download prompt, but this quickly escalates to a demand for Microsoft 365 credentials on a fake login page.<\/p>\n The malicious URL terminates in windows.net, specifically utilizing subdomains under blob.core.windows.net, which hosts the phishing form as a simple HTML file stored in Azure\u2019s blob storage service.\u200b<\/p>\nHow the Attack Leverages Azure Blob<\/strong><\/h2>\n