Email Blob Attack Bypasses Security Protections, Steals Passwords

Forbes - May 10th, 2025
Open on Forbes

A new threat targeting email users has emerged, utilizing Blob URIs to distribute phishing pages designed to steal user credentials. These 'email blob attacks' are proving difficult to detect and mitigate due to the unique nature of blob URIs, which are generated by browsers and accessible only to the originating browser. Security experts, such as Jacob Malimban from the Cofense Intelligence Team, highlight that this method has become a hacker's tool, complicating the task of differentiating between legitimate and malicious blobs, especially for AI-driven defenses.

The implications of these attacks are significant, as they exploit legitimate internet technology to bypass traditional security measures. Users are advised to be cautious of emails containing links with addresses starting with 'blob:http://' or 'blob:https://'. Current campaigns employing these tactics lure users with prompts to log in to receive encrypted messages or access financial accounts. The use of blobs, while legitimate in many instances, presents a formidable challenge in cybersecurity, emphasizing the need for heightened awareness and improved detection strategies.

Story submitted by Fairstory

RATING

6.8
Fair Story
Consider it well-founded

The article provides a clear and informative overview of a new cybersecurity threat involving blob URI-based phishing attacks. It effectively communicates the technical aspects of blob URIs and their potential misuse, making the content accessible to a general audience. The use of a credible source from the Cofense Intelligence Team enhances the article's reliability, although additional sources could provide a more balanced perspective.

While the article is timely and addresses a topic of public interest, it could have a greater impact by offering more actionable insights and recommendations for preventing such attacks. The lack of controversy limits its potential to provoke debate, but the engaging narrative and clear explanation of the threat make it a valuable resource for raising awareness.

Overall, the article succeeds in educating readers about a specific cybersecurity threat, but it could benefit from more diverse perspectives and practical advice to enhance its impact and engagement with the audience.

RATING DETAILS

7
Accuracy

The article presents a factual account of a new type of cyber threat involving blob URIs used in phishing attacks. It accurately describes how blob URIs function, noting that they are browser-generated and not accessible over the internet like traditional websites. This aligns with known technical details about blob URIs. The claim that these attacks are hard to detect due to their local nature is plausible, given that AI-based defenses may struggle with distinguishing between benign and malicious uses of blob URIs.

However, the article lacks specific evidence or examples of successful attacks, which would enhance its credibility. The mention of multiple campaigns using this methodology is a strong claim that requires further verification. Overall, the story's accuracy is supported by general knowledge of cybersecurity practices, but it could benefit from more detailed evidence and specific case studies to strengthen its claims.

6
Balance

The article primarily focuses on the threat posed by blob URI-based phishing attacks, presenting a clear narrative of the risks involved. It provides a technical explanation of blob URIs and their potential misuse, which is a balanced approach in terms of technical detail.

However, the article lacks perspectives from other cybersecurity experts or organizations, which could provide a more rounded view of the issue. Additionally, it doesn't explore potential countermeasures or the effectiveness of current security systems against such threats. Including these aspects would offer a more balanced perspective on the situation, addressing both the threat and potential solutions.

8
Clarity

The article is well-written and provides a clear explanation of a complex topic. The language used is accessible, making it easy for readers to understand the technical details of blob URIs and their misuse in phishing attacks. The structure is logical, with a clear progression from explaining the threat to discussing its implications.

The use of examples, such as comparing blob URIs to temporary data storage in browsers, helps to clarify the concept for readers who may not be familiar with technical jargon. Overall, the article effectively communicates the key points in a manner that is both informative and engaging.

7
Source quality

The article cites Jacob Malimban from the Cofense Intelligence Team, which lends credibility to the information presented, given Cofense's reputation in the cybersecurity field. This source provides authority and expertise on the topic, enhancing the article's reliability.

However, the story relies heavily on this single source, which limits the diversity of perspectives and insights. Incorporating additional sources, such as other cybersecurity experts or organizations, would improve the article's depth and reliability. The reliance on one expert's viewpoint may introduce bias or limit the scope of the discussion.

6
Transparency

The article is transparent in explaining the technical aspects of blob URIs and their role in phishing attacks. It clearly outlines the potential risks and how these attacks operate, providing readers with a solid understanding of the threat.

However, the article does not disclose any potential conflicts of interest or the methodology used to gather the information. A more detailed explanation of how the information was obtained, as well as any limitations or biases in the reporting, would enhance transparency. Additionally, providing more context about the prevalence and impact of these attacks would offer a clearer picture of the situation.

Sources

  1. https://www.securitymagazine.com/articles/101528-new-research-identifies-analyzes-an-email-bombing-attack
  2. https://www.mimecast.com/blog/world-password-day-2025-keeping-credentials-safe/
  3. https://blog.barracuda.com/2025/04/28/rising-threat-email-attachments-barracuda-2025-email-threats-report
  4. https://teckpath.com/common-email-attacks-2024-2025/
  5. https://blog.barracuda.com/2025/03/12/email-threat-radar-march-2025