Russian Star Blizzard hackers exploit WhatsApp accounts to spy on nonprofits aiding Ukraine

Star Blizzard (Callisto Group), a Russian state-linked APT, ran a mid-November phishing campaign impersonating U.S. officials to trick nonprofits supporting Ukraine into scanning malicious WhatsApp QR codes that linked victims’ accounts to attacker-controlled devices for message exfiltration; Microsoft and the DOJ have previously seized many of the group's domains, but the group adapted and shifted tactics to continue operations.