Skip to content

Sam's News — email-security — 2026-09-30

Email Security

7 Star Blizzard refines phishing and malware delivery with RedFlick technique

Microsoft has documented Russian state-sponsored actor Star Blizzard evolving its attack capabilities since January 2026 through large-scale phishing campaigns and a new malware delivery technique called RedFlick. This technique uses scheduled tasks to deploy the CosmicPulse backdoor with a single user interaction, reducing friction compared to previous ClickFix-based chains and improving the actor's ability to compromise targets.

  • RedFlick requires only a single user interaction versus multiple actions needed for previous ClickFix-based infection chains
  • Star Blizzard shifted toward large-scale phishing operations in 2026 alongside RedFlick adoption
  • Targets include Ukrainian individuals and institutions, international NGOs, Western think tanks, and governments with Ukraine-related nexus
  • RedFlick deploys CosmicPulse backdoor through scheduled tasks to evade detection

Sources: Microsoft Security Blog AI Web Searched