Phishers use Bubble no-code apps on bubble.io to steal Microsoft logins

In March 2026 Kaspersky described phishing emails whose links lead to apps built with Bubble, the AI-assisted no-code builder, and hosted on its trusted bubble.io domain. The app's only job is to forward victims to a fake Microsoft sign-in page. For anyone who builds or secures web apps it's a reminder that reputation-based filtering breaks down when attackers rent a legitimate platform's domain, and that a tangled frontend bundle can be its own form of obfuscation.

What happened

Kaspersky anti-spam expert Roman Dedenok published the research on 24 March 2026, and BleepingComputer covered it the next day. The chain Kaspersky observed:

1. A phishing email links to an app at an address like https://<name>.bubble.io/ rather than to the phishing site itself.
2. The Bubble app does nothing except redirect the visitor automatically.
3. The destination shows a Cloudflare verification check, which hides the real page from many automated scanners.
4. The victim then sees a convincing copy of a Microsoft sign-in page that harvests corporate credentials.

Kaspersky said the generated app code is "a massive jumble" of JavaScript and isolated Shadow DOM structures. That makes manual review slow and makes it more likely automated analysis will classify the page as a normal working site. Kaspersky expects phishing-as-a-service kits to adopt the technique. Bubble told BleepingComputer its platform was not breached, described the activity as criminals abusing a legitimate service, and said it acts on reported violations.

Who is affected

• Microsoft 365 / Entra ID users, whose stolen credentials give access to mail, calendars, files and anything federated through the same identity.
• Security teams that rely on URL reputation. A *.bubble.io subdomain inherits the parent domain's clean history.
• Legitimate Bubble customers, whose apps share a domain that some organisations may start to block or flag.

What it means for developers and engineering teams

Email gateways and secure web proxies weigh a link heavily by its domain's age and reputation. Shared hosting platforms (no-code builders, static hosts, serverless and edge platforms, form and doc tools) give every tenant a subdomain under one well-regarded parent, so a malicious tenant borrows that standing. Using the platform only as a redirect hop is cheap. It costs nothing to rebuild when taken down, and the credential page itself can sit behind a bot check that defeats sandboxed crawlers.

The Shadow DOM detail matters for anyone building detection. Shadow roots hide elements from document.querySelectorAll run against the main document, and heavy bundles make static inspection of the HTML nearly useless. A scanner has to render the page, walk shadow roots and watch where navigation actually goes. Attackers are using ordinary modern frontend output as camouflage.

The deeper fix sits with identity, not email. If a stolen password alone, or a password plus a phished one-time code relayed by an adversary-in-the-middle kit, is enough to sign in, link reputation will keep losing. Phishing-resistant authentication such as FIDO2 security keys or passkeys is bound to the real login origin, so it fails on a look-alike page.

What to do now

1. Move privileged and high-value users to phishing-resistant MFA (FIDO2 keys, Windows Hello for Business, passkeys) and use Conditional Access authentication strengths to require it.
2. Restrict sign-in context. Require compliant or managed devices for Microsoft 365 access so stolen credentials fail from an attacker's machine.
3. Treat shared-hosting subdomains as unknown, not trusted. Add rules in your email or web gateway to sandbox or warn on links to tenant subdomains of no-code and app-hosting platforms your organisation doesn't use.
4. Follow redirects when hunting. In proxy logs, look for a *.bubble.io hit followed within seconds by a request to a newly registered domain.
5. Watch Entra ID sign-in logs for impossible travel, new devices and token use from unfamiliar ASNs after a user clicks a reported phish. Revoke sessions, not just passwords.
6. Report abuse to the hosting platform. Bubble says it acts on flagged violations.

Related on TechLogHub

• Authentication: why phishing-resistant factors matter
• DOM: background on the Shadow DOM structures used here
• Lovable vs Bolt vs v0: the wider AI app-builder landscape

Sources

• Kaspersky blog: Bubble, a new tool for phishing scams (24 March 2026)
• Kaspersky press release on Bubble phishing (31 March 2026)
• BleepingComputer: Bubble AI app builder abused to steal Microsoft account credentials