BlueDelta (APT28) uses webhook.site and Microsoft Edge to hide HOOKEDGE espionage traffic targeting European governments.

Recorded Future’s Insikt Group documented a campaign by BlueDelta, the Russian GRU-linked group that overlaps with the group APT28, running an entire espionage operation against European government targets using webhook.site, a service built for developers to test HTTP requests, as its command-and-control backbone.

The campaign ran from late September 2025 through early April 2026, targeting government and diplomatic organizations in Romania, Spain, and Türkiye.

“The campaigns delivered a lightweight Windows batch-script backdoor, dubbed “HOOKEDGE,” via macro-enabled Microsoft Word documents using diplomatic-themed lures, including material impersonating Spain’s Ministry of the Presidency, Justice and Relations with the Cortes, created shortly after a September 2025 meeting between Spanish and Moldovan officials.” states the report by Insikt Group.

“Insikt Group assesses with moderate confidence that this activity was conducted by BlueDelta (which overlaps with APT28, Fancy Bear, and Forest Blizzard), a Russian state-sponsored threat group attributed to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).”

The attackers used a fairly old-school trick: macro-enabled Word documents. One of them looked like a real meeting agenda from Spain’s Ministry of the Presidency and appeared shortly after an actual meeting between Spanish and Moldovan officials. The timing was interesting because it came just before Moldova’s September 2025 parliamentary elections. The document looked credible enough to make the phishing attempt believable.

The backdoor, called HOOKEDGE, is surprisingly simple. It uses a Windows batch script and relies on two webhooks. One receives commands, while the other sends the stolen data back to the attackers. Every 30 minutes, a scheduled task downloads a command file through Microsoft Edge, runs it and sends the results to another endpoint. The malware uses Edge to make the traffic look like normal web activity, making it harder for security tools to spot.

That reliance on a real browser for both tasking and exfiltration is the cleverest part of the whole design.

“A notable aspect of HOOKEDGE is its use of msedge.exe for both tasking and exfiltration. By generating network traffic through a legitimate web browser rather than a commonly abused LotL binary (LOLBin) or a custom binary, the malware blends its communications with normal enterprise browsing activity.” continues the report.

Recorded Future explains, and that’s really the entire evasion strategy in one sentence: don’t build something exotic, just make your traffic look exactly like an employee checking a website.

BlueDelta didn’t build HOOKEDGE from scratch either. It shares deep code and structural overlap with HEADLACE, a backdoor the same group used years earlier, right down to identical JavaScript variable names and the same base64 encoding scheme for automated downloads.

“HOOKEDGE’s code and structural design have significant overlap with HEADLACE, a backdoor used by BlueDelta in previous campaigns.” states the report.

Recorded Future assesses with moderate confidence that HOOKEDGE is a direct evolutionary successor, maintained by the same operators rather than a fresh tool built by a different team, which fits BlueDelta’s long-documented habit of refining working tradecraft instead of reinventing it.

The operation also included a triage mechanism worth understanding on its own. Once a victim showed signs of being worth deeper attention, active communication with the initial webhook endpoints, BlueDelta deployed a second HOOKEDGE payload configured to check in every five minutes instead of thirty, giving operators much faster interactive control over higher-value targets. That two-tier setup also solved a practical infrastructure problem: webhook.site’s free tier caps out at 100 requests per endpoint, so spreading routine and high-priority tasking across separate endpoints kept any single one from getting exhausted mid-operation.

BlueDelta kept tuning the operation continuously rather than treating it as a finished product. Beaconing intervals stretched from 30 minutes to 61, deliberately timed to slip past sandbox environments that typically only watch a sample’s behavior for an hour. The group added canary tracking pixels named things like mailopened.jpg and docopened.jpg to monitor exactly when a phishing email got opened versus when the document itself got opened versus when macros actually executed, essentially building analytics for their own phishing funnel.

“The malicious document also contains a hidden image referencing a remote webhook URL: hxxp://webhook[.]site/62114596-33f5-47fb-9012-0223529e5a13/docopened[.]jpg. This serves as a document-open “canary,” alerting BlueDelta operators when a victim opens the lure. Later variants used the filename doc.jpg in place of docopened.jpg.” states Insik. “Insikt Group also identified webhooks using the filename mailopened.jpg, indicating that BlueDelta likely used a similar canary mechanism to monitor when recipients opened phishing emails, providing operators with visibility into campaign delivery success before any payload execution.”

That kind of detailed tracking of what victims do would look very familiar to a marketing team. The difference is that here the targets are victims, not customers.

For defenders, the useful indicators are quite clear. Block macros in documents downloaded from the internet, monitor scheduled tasks that launch scripts from user-writable folders, and flag Microsoft Edge running in headless mode or making automated connections to file-sharing and webhook services that the organization does not normally use. You don’t need sophisticated tools to spot these behaviors. Even a well-configured monitoring system should be able to detect them early. The worrying part is that a persistent, state-backed group can still rely on a small set of behaviors that defenders can identify and block.

For defenders, the actionable pieces here are concrete rather than abstract. Block macro execution from documents that arrived over the internet, watch for scheduled tasks spawning script interpreters from user-writable folders, and specifically flag Microsoft Edge running in headless mode or making automated requests to file-hosting and webhook services your organization doesn’t actually use for anything legitimate. None of this requires exotic tooling to catch, which is oddly reassuring: a threat group this persistent and state-backed is still, at its core, relying on the same handful of detectable behaviors that a properly configured monitoring setup would catch on day one.

“BlueDelta is likely to continue conducting initial access campaigns against European government and diplomatic organizations in support of Russian intelligence collection. Given the enduring strategic importance of European governance, NATO-related affairs, and diplomatic engagement with former Soviet republics, the intelligence requirements driving this activity are unlikely to diminish in the near term.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, BlueDelta)

Microsoft shut down the StegoAd campaign, which used 119 malicious Edge extensions, hit 2.6M installs, and ran undetected for two years.

Microsoft just shut down one of the more technically clever malicious extension campaigns it’s ever documented. The operation, named StegoAd, ran 119 extensions on the Edge Add-ons store, racked up roughly 2.6 million installs, and stayed alive for at least two years. The threat actor behind it has been active since 2021.

“Over the past several years, the Microsoft Edge Extensions Security team has tracked a persistent threat actor operating one of the most technically sophisticated malicious browser extension campaigns we have encountered.” reads the report published by Microsoft. “We call it StegoAd, a name combining steganography and ad injection, the two pillars of the campaign’s methodology.”

The extensions looked completely normal. Ad blockers, VPNs, translators, video downloaders, they all worked. They earned positive reviews. The malicious payload didn’t activate until days after installation, which is exactly how the campaign survived multiple detection sweeps.

The name comes from steganography, the practice of hiding data inside ordinary files. This actor hid executable JavaScript inside PNG icon files, then WebP images, then WOFF2 font files. Static scanners saw valid images. What actually ran was a multi-stage attack suite.

“This encoding technique stores JavaScript payload characters as high Unicode codepoints, values in the CJK Unified Ideograph and Private Use Area ranges that overlap with character ranges defined in WOFF2 font files.” continues the report. “To a scanner, it looks like Asian text or font metadata. To the decoder, it’s an executable JavaScript”

The earliest technique appended JavaScript code after the IEND marker at the end of a PNG file. The image rendered perfectly in any viewer. The extension’s own background script read the icon as raw text, found a custom marker string, pulled out everything after it, and executed it. No suspicious domain calls. No obvious obfuscation in the JavaScript source. Standard scanners found nothing.

When PNG detection improved, the actor moved to WebP containers. Same idea, different format, less scrutiny from security tools at the time. After that came WOFF2 font files, where payload characters were stored as high Unicode codepoints in glyph ranges that look like Asian text or font metadata to any scanner that doesn’t decode them.

The most recent variant, spotted in March 2026, disguised a PNG file as a configuration file called setting.conf. The extension fetched it, searched for the marker_vpn_settings, and decoded a Base64 payload split into segments by a ///// delimiter. Calling it a settings file was a nice touch.

The extension stayed dormant for three to five and a half days after installation. Some variants only activated in 10% of sessions on top of that. If you opened DevTools to inspect the extension, a flag called dipFlgDev was set and the dormancy period extended indefinitely. The payload would never fire while an analyst was watching.

The command-and-control server added another layer. It only served real payloads to requests that passed a fingerprint check built from the extension’s own runtime ID, plus the correct User-Agent. Researchers probing the C2 directly got an empty decoy response. The full payloads Microsoft analyzed were intercepted from controlled infected instances, not retrieved by querying the server.

The polymorphic framework, called orderArray, ran across 66 extensions with over 15 naming variants. Every instance had the same four-component structure: an encoded payload object, a seed generator using the extension’s runtime ID, a regex decoder, and a double-Base64 extractor. Variable and function names changed completely across each variant, which defeated fixed-pattern detection rules.

Ad fraud was the visible layer. The extensions injected ads, replaced existing Google AdSense and Amazon ad slots with the actor’s own (capped at six replacements per page to avoid suspicion), and hijacked affiliate commissions on Amazon across more than 20 country-specific stores, plus eBay, AliExpress, Taobao, and JD.com.

Underneath that was a full remote code execution backdoor. The C2 server could push arbitrary JavaScript to any victim’s browser and have it execute within 10 milliseconds. Every extension in the campaign received the same payload modules, meaning all 2.6 million users were exposed to the complete attack surface, not just the ad fraud piece.

The credential theft module targeted Google sign-in pages. It captured the password, waited for the 2FA prompt, captured that code too, and sent both to mitarchive.info via double-Base64 encoding. A separate module hit WordPress admin login pages and attached a SimilarWeb link to each stolen credential so the operator could sort stolen sites by traffic value before deciding what to do with them.

Seven Google Analytics tracking IDs served as the campaign’s telemetry infrastructure. The operator tracked active installs, geographic distribution, merchant click counts, per-ad-replacement performance, and extension version numbers, all through Google’s own dashboard. Hosting telemetry on Google infrastructure meant those beacons blended in completely with normal web traffic.

Two GA4 beacons were served through GitHub Pages. The operator was running what amounts to a professional analytics setup for a criminal campaign, on free hosting, using Google’s tools.

The campaign migrated from Manifest V2 to Manifest V3 as browser platforms tightened restrictions. Where MV2 allowed real-time JavaScript interception of HTTP responses, MV3 requires static declarative rules. The actor solved this by fetching those rules dynamically from the C2 server and installing them into the browser’s declarativeNetRequest API every 15 days. The result was the same header-stripping capability through a more constrained interface.

Each time a wave of extensions was removed, the actor responded within weeks. The C2 domains shifted, encryption schemes changed, and new steganographic formats appeared. Microsoft’s analysis describes a clear detect-and-adapt pattern across eight major milestones from March 2024 through April 2026.

Microsoft has not named the threat actor. Koi Security has linked the credential exfiltration domain mitarchive.info to DarkSpectre, a Chinese operation previously connected to the ShadyPanda and GhostPoster campaigns. StegoAd shares the icon steganography method with GhostPoster and even reuses some extension names, including “Ads Block Ultimate.”

The full list of 119 extension IDs is in Microsoft’s technical report. Open edge://extensions and check your installed add-ons against it. If anything matches, treat the browser as compromised: change your Google password, review recent sign-in activity at myaccount.google.com/security, and check WordPress and Amazon accounts for anything you didn’t do.

“Hardware security keys hold up against this kind of 2FA interception in a way that SMS codes and authenticator apps do not. If you’re still using SMS for 2FA on accounts that matter, this campaign is a reasonable argument for upgrading.” concludes the report. “The StegoAd campaign demonstrates clear technical evolution over 2+ years, with the actor consistently adapting to detection pressure” concludes the report. “The progression also reveals strategic priorities: the actor invests heavily in payload concealment (steganography variants evolved four times) while keeping the monetization logic largely stable. This asymmetry suggests the actor views detection of evasion, not feature development as the primary operational constraint.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, StegoAd)