Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net
ID: 5b531aa7-9f64-5ca1-82ab-431b725a2d18
STIX ID: report--5b531aa7-9f64-5ca1-82ab-431b725a2d18
Feed Name: CosmicBytez Labs
Threat Score
Star Blizzard, an FSB-linked APT active since 2017, has replaced its multi-step ClickFix social engineering with a single-interaction RedFlick delivery that drops the CosmicPulse Python backdoor via password-protected archives and living-off-the-land techniques; Microsoft observed 12+ campaigns since January 2026 targeting 100+ organizations (mainly US/UK) and recommends hunting for RedFlick/CosmicPulse indicators, enforcing attachment controls, and verifying event invitations out-of-band.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.