Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net

Microsoft Threat Intelligence reports that Russia-linked APT Star Blizzard (ColdRiver/Callisto) has evolved its phishing-to-malware delivery by adopting a RedFlick technique that uses scheduled tasks and trusted Windows components to deploy the CosmicPulse backdoor with minimal user interaction; since January the actor has run at least 13 large-scale phishing campaigns targeting NGOs, think tanks, journalists and government organizations, leveraging LNK files in password-protected archives, MSI installers, PowerShell concealed in PDFs, steganography and even iOS targeting (DarkSword). The advisory details the infection chains, defensive mitigations (phishing-resistant authentication, conditional access, EDR in block mode, Defender SmartScreen) and warns defenders to test detection of the full chain from click to backdoor.