InfoSecBulletin Cybersecurity for mankind
BlueDelta conducted a complex credential-harvesting operation targeting critical infrastructure and research institutions in 2025, as revealed by an investigation from Recorded Future’s Insikt Group.
The campaigns leveraged legitimate PDF documents as bait, including publications from the Gulf Research Center titled “Strategic and Political Implications for Israel and Iran: The Day After War” and the EcoClimate Foundation’s report on “Climate Action as a Strategic Priority for the New Pact for the Mediterranean”.
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Microsoft Reveals Project Zenith Windows PCs Able to Run 30B+ AI Models Locally
Google issues warning of new Chrome zero-day flaw exploited
Fraudulent login screens were shown to victims using fake documents to appear legitimate and evade security systems.
Multi-Stage Infrastructure Abuse:
BlueDelta relied on free hosting and tunneling services, showing the group’s ongoing preference for low cost, temporary infrastructure that makes attribution harder.
The campaigns abused Webhook[.]site, InfinityFree, Byet Internet Services, ngrok, and ShortURL to host phishing content, capture credentials, and manage complex redirection chains.
Threat actors used complex redirection methods, starting with shortened URLs that led victims through various webhooks before showing pages to steal credentials.
This method enabled BlueDelta to show real PDF documents for short times, collect beacons with victim email addresses and metadata, and create realistic copies of Microsoft Outlook Web Access, Google, and Sophos VPN login pages.
Analysis of BlueDelta’s credential-harvesting pages revealed iterative improvements in their operational tradecraft.
The group created automated JavaScript functions that automatically captured page URLs, removing the need to manually set exfiltration endpoints.
BlueDelta changed the variable name from “OldPwd” to “password” in recent campaigns, showing improved code for better operations.
On July 16, 2025, BlueDelta made a new phishing page using the free Webhook[.]site API, located at hxxps://webhook[.]site/ff237e88-cbaf-4b0b-b787-6e2f1f2c926f.
Threat actors used unique 32-byte hexadecimal IDs in URL query strings to track individual victims during the credential-harvesting process.
On June 4, 2025, BlueDelta launched a credential-harvesting page disguised as a Sophos VPN password reset page.
Custom scripts monitored victim activity through beacons, sent credentials via HTTP POST in JSON, and redirected victims to real services after submission to avoid raising suspicion.
BlueDelta’s ongoing misuse of legitimate online services highlights the GRU’s view that credential harvesting is an efficient way to gather intelligence for Russian goals.
Organizations can reduce risk by using phishing-resistant multi-factor authentication, blocking unnecessary free hosting and tunneling services, and monitoring authentication attempts from proxy services or unusual ports.
