New Star Blizzard spear-phishing campaign targets WhatsApp accounts

Microsoft Threat Intelligence reports that the Russian actor Star Blizzard shifted tactics in Oct–Nov 2024 to a spear‑phishing campaign that lures targets to scan malicious WhatsApp linking QR codes (or follow shortened links) to pair attacker-controlled WhatsApp Web sessions and exfiltrate messages; the blog describes targeting (government/diplomacy, defense/Russia researchers, Ukraine-related assistance), lists two malicious domains observed, provides mitigations, hunting queries, and detections, and notes the activity appeared limited and wound down by end of November.