Cybercriminals are bypassing phishing defenses in attacks targeting Microsoft users by exploiting the no-code development platform Bubble to create and host harmful web applications.

Because these web applications are hosted on a trustworthy platform, email security systems often fail to identify the links as dangerous, allowing users to visit the malicious pages.

Kaspersky researchers have discovered that attackers are using this technique to reroute users to phishing sites, frequently designed to look like Microsoft login pages, sometimes hidden behind a Cloudflare security check.

If victims enter their credentials on these fraudulent pages, the attackers steal them and can use them to access email, calendar data, and other sensitive information related to the victim’s Microsoft 365 account.

Bubble is a no-code, AI-driven platform that automatically generates backend logic and frontend design based on a user’s description of the desired application.

Applications developed with Bubble are hosted on Bubble’s infrastructure under the *.bubble.io domain, which is often trusted and thus unlikely to raise security alerts from email security measures.

Attackers exploit this trust by designing Bubble applications containing substantial, complex Javascript code and Shadow DOM structures, making them difficult to detect as malicious redirection scripts by automated analysis tools.

“The code generated by this no-code platform is a complex mixture of Javascript and isolated Shadow DOM structures,” Kaspersky states.

“Even experts find it difficult to immediately understand how the code works and for what purpose; a thorough examination is required.”

“Automated web-code analysis tools are even more susceptible to error, often concluding that these sites are functional and useful.”

Researchers caution that phishing-as-a-service (PhaaS) platforms are likely to adopt this AI-powered app builder abuse for evasion, integrating it into phishing kits used by less skilled cybercriminals.

Since these platforms already include features like session cookie theft, adversary-in-the-middle (AiTM) layers to circumvent two-factor authentication (2FA), geo-fencing, anti-analysis techniques, and AI-generated email content, abusing legitimate platforms like Bubble will further enhance attack stealth.

BleepingComputer has reached out to Bubble for comments on these findings from Kaspersky and any potential measures to bolster anti-abuse protections but has not yet received a response at the time of publication.