InfoSecBulletin Cybersecurity for mankind
BlueDelta conducted a complex credential-harvesting operation targeting critical infrastructure and research institutions in 2025, as revealed by an investigation from Recorded Future’s Insikt Group.
The campaigns leveraged legitimate PDF documents as bait, including publications from the Gulf Research Center titled “Strategic and Political Implications for Israel and Iran: The Day After War” and the EcoClimate Foundation’s report on “Climate Action as a Strategic Priority for the New Pact for the Mediterranean”.
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Fraudulent login screens were shown to victims using fake documents to appear legitimate and evade security systems.
Multi-Stage Infrastructure Abuse:
BlueDelta relied on free hosting and tunneling services, showing the group’s ongoing preference for low cost, temporary infrastructure that makes attribution harder.
The campaigns abused Webhook[.]site, InfinityFree, Byet Internet Services, ngrok, and ShortURL to host phishing content, capture credentials, and manage complex redirection chains.
Threat actors used complex redirection methods, starting with shortened URLs that led victims through various webhooks before showing pages to steal credentials.
This method enabled BlueDelta to show real PDF documents for short times, collect beacons with victim email addresses and metadata, and create realistic copies of Microsoft Outlook Web Access, Google, and Sophos VPN login pages.
Analysis of BlueDelta’s credential-harvesting pages revealed iterative improvements in their operational tradecraft.
The group created automated JavaScript functions that automatically captured page URLs, removing the need to manually set exfiltration endpoints.
BlueDelta changed the variable name from “OldPwd” to “password” in recent campaigns, showing improved code for better operations.
On July 16, 2025, BlueDelta made a new phishing page using the free Webhook[.]site API, located at hxxps://webhook[.]site/ff237e88-cbaf-4b0b-b787-6e2f1f2c926f.
Threat actors used unique 32-byte hexadecimal IDs in URL query strings to track individual victims during the credential-harvesting process.
On June 4, 2025, BlueDelta launched a credential-harvesting page disguised as a Sophos VPN password reset page.
Custom scripts monitored victim activity through beacons, sent credentials via HTTP POST in JSON, and redirected victims to real services after submission to avoid raising suspicion.
BlueDelta’s ongoing misuse of legitimate online services highlights the GRU’s view that credential harvesting is an efficient way to gather intelligence for Russian goals.
Organizations can reduce risk by using phishing-resistant multi-factor authentication, blocking unnecessary free hosting and tunneling services, and monitoring authentication attempts from proxy services or unusual ports.
