New Phishing Attack Leverages Azure Blob Storage to Impersonate Microsoft
Threat actors have been leveraging Microsoft Azure Blob Storage to create phishing sites that imitate legitimate Office 365 login portals, posing a significant risk of credential theft to Microsoft 365 users.
Threat actors have been leveraging Microsoft Azure Blob Storage to create phishing sites that imitate legitimate Office 365 login portals, posing a significant risk of credential theft to Microsoft 365 users.
This method takes advantage of the trusted Microsoft infrastructure, making it challenging to identify these fraudulent pages since they appear secured by official SSL certificates issued by Microsoft.
Recent reports indicate a rise in such campaigns, with warnings issued on Tue, Oct 17, 2025, urging immediate vigilance among enterprises and individuals.
The phishing scheme typically begins with deceptive emails containing links disguised as routine Microsoft Forms surveys or document shares. These often start with URLs like forms.office[.]com, followed by a unique identifier.
When victims click these links, they are redirected to what appears to be a harmless PDF download prompt but quickly escalates to a demand for Microsoft 365 credentials on a fake login page.
Recent reports indicate a rise in such campaigns, with warnings issued on Tue, Oct 17, 2025, urging immediate vigilance among enterprises and individuals.
The malicious URLs end in windows.net, specifically using subdomains under blob.core.windows.net, which host the phishing form as a simple HTML file stored in Azure's blob storage service.
This storage solution, intended for unstructured data like images or documents, inadvertently provides phishers with a veil of legitimacy since browsers and endpoint protection tools inherently trust Azure endpoints.
Upon entering their email and password, user credentials are captured and sent to attacker-controlled servers, potentially granting access to sensitive emails, files, and tenant resources.
Attackers may then escalate privileges to intercept authentication tokens or infiltrate the entire organization. Similar tactics have been noted in previous reports, using themed PDF attachments posing as legal documents.
Block all traffic to *.blob.core.windows.net endpoints in firewalls or web proxies, while whitelisting only specific, trusted storage accounts like <your-storage-account>.blob.core.windows.net. Enable multi-factor authentication (MFA) and monitor for anomalous logins via Microsoft Entra ID to detect breaches early. Customize company branding in your Microsoft 365 tenant to display the organization’s logo, colors, and name on official sign-in pages, helping users identify legitimate portals.
This phishing variant highlights the dual-edged nature of cloud services: while Azure Blob Storage offers scalability and security for legitimate use, it becomes a weapon when misused by threat actors.
Organizations should prioritize user education on scrutinizing URLs, as legitimate Office 365 logins always direct to login.microsoftonline.com, not blob storage paths.
Based on reporting by Cyber Security News.