Phishing attempt against Reporters Without Borders attributed to Russia-linked group

A Russia-aligned threat actor known as Callisto (ColdRiver/Star Blizzard) conducted a targeted phishing campaign in March that attempted to harvest credentials from Reporters Without Borders and another organization by impersonating trusted contacts via ProtonMail, sending links that redirected to a malicious PDF or a ProtonMail phishing kit. The campaign used decoy content and injected JavaScript to coerce credential entry; ProtonMail blocked the operator’s account and the malicious PDF was not retrieved in the RSF attempt. The report places the activity in the context of Callisto’s ongoing espionage operations against NGOs, governments, and organizations supporting Ukraine.