CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Abuse of Bubble AI app builder infrastructure in credential phishing campaigns targeting Microsoft accounts

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

Threat actors are leveraging the no-code AI-powered app-building platform Bubble to host and deliver credential phishing web apps targeting Microsoft accounts. The malicious apps, hosted on Bubble’s trusted *.bubble.io domain, evade email security controls by bypassing static and automated analysis due to their complex JavaScript and Shadow DOM structures. Users are redirected to phishing portals mimicking Microsoft login interfaces, often protected by Cloudflare checks, to harvest credentials for Microsoft 365 access, including email, calendar, and sensitive data.

Timeline

  1. 25.03.2026 21:48 1 articles · 3h ago

    Credential phishing campaigns target Microsoft accounts via Bubble AI app builder abuse

    Threat actors are hosting malicious web apps on Bubble’s *.bubble.io domain to deliver phishing pages mimicking Microsoft login portals. Complex JavaScript and Shadow DOM structures within Bubble-generated apps evade static and automated analysis, allowing campaigns to bypass email security controls and Cloudflare-based anti-analysis checks. Credentials entered on these phishing pages are exfiltrated to threat actors for access to Microsoft 365 accounts, including email and calendar data.

    Show sources
    Open in new tab

Information Snippets

  • Malicious Bubble apps are generated using AI-driven platform features, producing large, obfuscated JavaScript bundles and Shadow DOM structures that evade static and automated security analysis tools.

    First reported: 25.03.2026 21:48
    1 source, 1 article
    Show sources

  • Phishing campaigns exploit Bubble’s hosting infrastructure under the *.bubble.io domain, a trusted domain unlikely to trigger email security warnings.

    First reported: 25.03.2026 21:48
    1 source, 1 article
    Show sources

  • Phishing pages often mimic Microsoft login portals and may include Cloudflare checks to hinder automated detection and analysis.

    First reported: 25.03.2026 21:48
    1 source, 1 article
    Show sources

  • Stolen Microsoft account credentials are used to access email, calendar, and other sensitive Microsoft 365 data associated with compromised accounts.

    First reported: 25.03.2026 21:48
    1 source, 1 article
    Show sources

  • Kaspersky researchers warn that this tactic will likely be adopted by phishing-as-a-service (PhaaS) platforms and integrated into broader phishing kits, enhancing evasion capabilities for lower-tier cybercriminals.

    First reported: 25.03.2026 21:48
    1 source, 1 article
    Show sources