Microsoft reports real-world Star Blizzard phishing campaigns where victims who engage with an initial email receive a follow-up message containing a password-protected ZIP/RAR attachment. The attachment chain hides a malicious shortcut disguised as a PDF, opening a decoy file while quietly downloading and installing additional malware. Targets included Ukrainian individuals and institutions plus NGOs, think tanks, governments, and financial institutions supporting Ukraine.
Star Blizzard's phishing operation relied on a staged, reply-first workflow rather than a single malicious email. The initial message was crafted to look like it came from inside the target organization, or from Ukrainian authorities or a reputable think tank or NGO, and simply asked the recipient to confirm receipt or engage in conversation. Only after the target replied did the attacker send a second email containing a password-protected ZIP or RAR archive. That archive held the actual payload: a VHDX container with a shortcut file disguised as a PDF. Clicking the fake PDF opened a decoy document while quietly executing a background script. Later variants of the chain fetched an MSI installer and used scheduled tasks for persistence, with some campaigns in July using a multistage PowerShell execution chain triggered by the malicious shortcut.
The two-step delivery model is effective because it defeats automated scanning: security tools analyzing the first email see nothing malicious, since the actual archive only arrives after a human has replied and demonstrated engagement. The password-protected archive adds another layer of evasion, since scanners generally cannot inspect encrypted file contents. Spoofing an internal sender or a trusted Ukrainian authority or NGO also lowers suspicion, since recipients are primed to expect legitimate correspondence from those sources.
Organizations supporting Ukraine, including governments, NGOs, think tanks, financial institutions, and academic groups, should train staff to treat "reply-first" emails with caution, since the real payload often only appears after engagement. Staff should verify password-protected archives through a separate trusted channel before opening them, and should never open unfamiliar container formats like VHDX. Reporting unusual attachment types to security teams, rather than opening them to "check quickly," closes off the critical step where the RedFlick chain executes its background script and begins the malware installation process.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The attacker only sends the malicious attachment after the target replies to an initial, seemingly harmless email, which helps the payload evade automated scanning that only sees the first message.
Password-protected archives prevent email security scanners from inspecting the contents, letting the malicious file bypass automated detection before a human opens it.
Star Blizzard attached a Virtual Hard Disk (VHDX) container holding a shortcut file disguised as a PDF; clicking it opens a decoy document while quietly running a background script that installs malware.
Targets included Ukrainian individuals and institutions, plus NGOs, think tanks, governments, and financial institutions supporting Ukraine.
You get an email that looks internal: “Hi, can you confirm receipt? I’ll send the document in a protected archive once you reply.” This is Star Blizzard’s RedFlick trick: once you reply, they send a password‑protected ZIP or RAR that our scanners can’t see into, holding a VHDX file with a fake PDF inside. Click that “PDF” and it opens a harmless-looking decoy, while in the background it pulls down an MSI installer or PowerShell chain and sets scheduled tasks to stay on your machine. If any “internal” email makes you reply first, then sends a password‑protected ZIP or a weird VHDX “document,” stop and report it to security, don’t open it.
Microsoft reports Russia-linked Star Blizzard sent fake event invitations and other business notices to trick targets into opening disguised files that install a Windows backdoor. The campaigns targeted Ukraine-linked people and organizations and hit 100+ organizations, mainly in the U.S. and U.K.,…
Microsoft reports that the Russian state-linked actor Star Blizzard ran large-scale phishing campaigns in 2026 that use convincing lures like tax notices, fines, and “closed-door” event invitations. After a victim replies, the attacker sends a password-protected ZIP/RAR attachment that triggers a…
Microsoft reported real phishing campaigns that trick users into running a legitimate MSP360 remote-management installer disguised as meeting invites, PDFs, and software updates. After MSP360 is installed, attackers use it to silently install ScreenConnect as a second remote-access path, then use…
Researchers describe real-world “ClickFix” social-engineering lures that trick people into installing malware by downloading fake apps (like Spotify/Zoom/Teams) or copying commands into Terminal. One campaign abused a compromised, verified HBO Max Reddit account to run malicious ads, while another…
Researchers say the North Korea-linked Lazarus group ran “Operation Dream Job,” posing as recruiters and sending fake job offers to lure targets into downloading trojanized PDF tools and opening booby-trapped PDFs. The campaign focused largely on defense-related organizations and used both a…
Researchers reported a real spear‑phishing intrusion against a law firm where attackers sent a message with a link to an encrypted archive. The archive contained a Windows shortcut (LNK) disguised as “Case Documents,” and running it launched a multi‑stage loader (“HollowFrame”) that ultimately…
