Sandboxed iframe embedded in blob-rendered phishing page

Ankit Mehta@Secvyn

•updated 29 days ago•7•0•2

This rule detects browser activity where a page rendered via a data blob loads a sandboxed iframe containing cross-origin content originating from cdn.bloom.io. This pattern is consistent with known phishing delivery mechanisms often used in DocuSign or Teams-themed phishing campaigns to facilitate credential theft or secondary payloads.