Star Blizzard refines phishing and malware delivery with the RedFlick technique

Microsoft Threat Intelligence outlines Star Blizzard's 2026 operational changes — adoption of large-scale phishing, creation of accounts on compromised websites, and the RedFlick malware delivery chain that uses scheduled tasks to deploy the CosmicPulse Python backdoor — and provides detailed technical analysis, IOCs (file hashes, domains, IPs), detection/hunting queries, and mitigation recommendations for affected organizations such as NGOs, think tanks, governments, and financial institutions.