BlueDelta, a Russian state-sponsored threat group linked to the country’s military intelligence agency known as the GRU, has expanded its credential-stealing operations significantly throughout 2025.
Between February and September, the group launched multiple phishing campaigns designed to deceive users of Microsoft Outlook Web Access, Google, and Sophos VPN services into surrendering their login information.
This evolving threat demonstrates the group’s commitment to harvesting credentials from government officials, energy sector workers, and research professionals across Europe and Eurasia.
The attacks represent a clear evolution of BlueDelta’s long-standing tradecraft, which has targeted sensitive organizations since the mid-2000s.
The group focuses primarily on institutions connected to energy research, defense cooperation, and government communication networks.
The recent campaigns show increased sophistication in how BlueDelta combines multiple attack stages, custom code, and authentic-looking lure documents to bypass security controls and boost victim confidence.
Recorded Future analysts identified the malware after the second deployment phase, uncovering the technical mechanisms behind each attack.
The researchers discovered that BlueDelta relies heavily on free hosting services like Webhook.site, InfinityFree, Byet Internet Services, and ngrok to host the fake login pages and automatically capture stolen credentials.
.webp "BlueDelta Hackers Attacking Microsoft OWA, Google, and Sophos VPN Users to Steal Logins 3")
This infrastructure strategy keeps operational costs minimal while maintaining flexibility through disposable services.
Multi-Stage Credential Capture Mechanism
The infection mechanism BlueDelta employs follows a carefully orchestrated chain of redirections designed to collect user data while maintaining a veneer of legitimacy.
When a victim clicks a phishing link, they first encounter legitimate PDF documents from organizations like the Gulf Research Center.
.webp "BlueDelta Hackers Attacking Microsoft OWA, Google, and Sophos VPN Users to Steal Logins 4")
These documents display for approximately two seconds before the page automatically redirects to a spoofed login portal that mirrors the appearance of authentic Microsoft, Google, or Sophos interfaces.
The malicious code uses JavaScript functions to capture victim information systematically.
The code extracts email addresses from the URL parameters and sends a “page-opened” beacon containing the victim’s email, IP address, and browser information back to BlueDelta’s command server.
When victims enter their credentials, additional JavaScript captures the username and password, then transmits this information via HTTP POST requests to the attacker-controlled endpoint.
What makes this particularly effective is BlueDelta’s modification of the browser’s displayed URL.
.webp "BlueDelta Hackers Attacking Microsoft OWA, Google, and Sophos VPN Users to Steal Logins 5")
After credentials are submitted, the page changes from showing the phishing domain to displaying “/owa/” or “/pdfviewer?pdf=browser,” creating the impression of a legitimate application interface.
The page then redirects to the authentic PDF or a real login portal belonging to the targeted organization, making victims believe they completed a normal authentication process.
The group’s continuous refinement of these techniques illustrates a sophisticated understanding of user psychology and web browser behavior, allowing BlueDelta to maintain high success rates in credential harvesting while evading detection.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
