BLOB Based Phishing Scams
Source: YouTube · John Hammond · published Jan 14, 2025 · 19:43
The video analyzes a DocuSign phishing scam that uses Google Firebase hosting and a blob technique to steal credentials, demonstrating how easily such scams can be created and how they evade detection 0:00-1:16.
Key Takeaways:
• The phishing email pretends to be a secure document from DocuSign but contains obvious red flags like being sent from a SharePoint contact rather than DocuSign 0:00-0:16
• Attackers host the phishing page on Google Firebase, which allows for quick and easy setup of scam websites 1:41-2:28
• The scammers use a blob technique where the actual phishing page is hidden in base64-encoded JavaScript and only rendered when the victim clicks, helping them avoid detection by security scanners 9:33-12:31
• When victims enter their credentials, the information is sent to a compromised WordPress server through a PHP script that forwards the stolen data to the attackers 16:20-17:38
• Password managers can provide protection against such scams as they typically won't autofill credentials on blob-based phishing pages 18:29-18:45
The video serves as both an educational analysis of a real phishing scam and a warning about the sophisticated techniques used by cybercriminals to steal sensitive information 19:37-19:39.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
this is a scam email it's a fishing email with the pretense that you have a document that you need to review and sign sent to you via doc you sign but the fishing email kind of sucks it's pretty bad you can probably see a whole lot of red flags here coming from uh SharePoint contact oc.com uh SharePoint is not really related to Doc you sign they say it's a secure encrypted message that you've received if an innocent unknowing victim were to click the button here to view your message and fall for this scam you'd be presented with this page in your web browser where you've got a PDF icon a file sent to you or available for download but you're required to log in with your email address and once you click next it will ask you for your password now of course it's exfiltrating your password it's…