Phish - Data URI Scheme Obfuscation (T1027)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•3

Identifies instances where a browser process is spawned directly with a Base64-encoded data: URI in its command line. This technique is used to load malicious HTML content without touching the disk or network, often associated with phishing attempts.