Russian Spear-Phishing Campaign Targets WhatsApp Accounts

Microsoft researchers report a Star Blizzard spear-phishing campaign targeting people who assist Ukraine: attackers send emails with a deliberately broken QR code to prompt replies, then deliver a Safe Links-wrapped shortened URL that redirects victims to a working WhatsApp Web QR code. If victims scan it, the adversary can link the victim's WhatsApp to a controlled session and exfiltrate messages using browser plugins; the campaign includes impersonation of a US government official to increase engagement.