InfoSecBulletin Cybersecurity for mankind
BlueDelta conducted a complex credential-harvesting operation targeting critical infrastructure and research institutions in 2025, as revealed by an investigation from Recorded Future’s Insikt Group.
The campaigns leveraged legitimate PDF documents as bait, including publications from the Gulf Research Center titled “Strategic and Political Implications for Israel and Iran: The Day After War” and the EcoClimate Foundation’s report on “Climate Action as a Strategic Priority for the New Pact for the Mediterranean”.
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
Fraudulent login screens were shown to victims using fake documents to appear legitimate and evade security systems.
Multi-Stage Infrastructure Abuse:
BlueDelta relied on free hosting and tunneling services, showing the group’s ongoing preference for low cost, temporary infrastructure that makes attribution harder.
The campaigns abused Webhook[.]site, InfinityFree, Byet Internet Services, ngrok, and ShortURL to host phishing content, capture credentials, and manage complex redirection chains.
Threat actors used complex redirection methods, starting with shortened URLs that led victims through various webhooks before showing pages to steal credentials.
This method enabled BlueDelta to show real PDF documents for short times, collect beacons with victim email addresses and metadata, and create realistic copies of Microsoft Outlook Web Access, Google, and Sophos VPN login pages.
Analysis of BlueDelta’s credential-harvesting pages revealed iterative improvements in their operational tradecraft.
The group created automated JavaScript functions that automatically captured page URLs, removing the need to manually set exfiltration endpoints.
BlueDelta changed the variable name from “OldPwd” to “password” in recent campaigns, showing improved code for better operations.
On July 16, 2025, BlueDelta made a new phishing page using the free Webhook[.]site API, located at hxxps://webhook[.]site/ff237e88-cbaf-4b0b-b787-6e2f1f2c926f.
Threat actors used unique 32-byte hexadecimal IDs in URL query strings to track individual victims during the credential-harvesting process.
On June 4, 2025, BlueDelta launched a credential-harvesting page disguised as a Sophos VPN password reset page.
Custom scripts monitored victim activity through beacons, sent credentials via HTTP POST in JSON, and redirected victims to real services after submission to avoid raising suspicion.
BlueDelta’s ongoing misuse of legitimate online services highlights the GRU’s view that credential harvesting is an efficient way to gather intelligence for Russian goals.
Organizations can reduce risk by using phishing-resistant multi-factor authentication, blocking unnecessary free hosting and tunneling services, and monitoring authentication attempts from proxy services or unusual ports.
