BlueDelta Hackers Attacking Microsoft OWA, Google, and Sophos VPN Users to Steal Logins

Cybersecuritynews •Tushar Subhra Dutta • January 8, 2026

BlueDelta, a Russian state- threat group linked to the country’s military intelligence agency known as the GRU, has expanded its credential-stealing operations significantly throughout 2025. Between February and September, the group launched multiple phishing campaigns designed to deceive users of Microsoft Outlook Web Access, Google, and Sophos VPN services into surrendering their login information. This […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

BlueDelta Hackers Target Microsoft OWA, Google, and Sophos VPN for Credential Theft The BlueDelta hacking group, linked to Russian military intelligence, has intensified its credential-stealing efforts throughout 2025. Users of Microsoft Outlook Web Access, Google services, and Sophos VPN have been targeted through multiple phishing campaigns aimed at extracting login information. The attacks occurred between February and September 2025, highlighting a significant escalation in the group's operations. 2 sources 29

Extracted Entities

BlueDelta Hackers Attacking Microsoft OWA, Google, and Sophos VPN Users to Steal Logins

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Companies (3)

MITRE ATT&CK (1)

Platforms (2)