Microsoft reports that the Russian state-linked actor Star Blizzard ran large-scale phishing campaigns in 2026 that use convincing lures like tax notices, fines, and “closed-door” event invitations. After a victim replies, the attacker sends a password-protected ZIP/RAR attachment that triggers a new “RedFlick” malware delivery flow to install the CosmicPulse backdoor with minimal user interaction.
Microsoft reports that Star Blizzard shifted in 2026 from narrowly targeted spearphishing to larger-scale email campaigns reaching tens to hundreds of recipients per run. The workflow depends on a two-stage exchange: an initial email uses a lure such as a Ukrainian tax audit notice, a payment advice note, or an invitation to a closed-door policy event. Once the recipient replies, expressing interest or simply engaging with the message, the attacker follows up with a password-protected ZIP or RAR archive. The password itself is delivered as an image rather than as text, a tactic aimed at evading automated content scanning.
This follow-up archive triggers the RedFlick delivery flow, which Microsoft describes as reducing the number of actions a victim needs to take to a single interaction. RedFlick uses scheduled tasks to install the CosmicPulse backdoor and downloader with minimal further engagement from the target.
Several factors work together to make these campaigns effective. The lures are tailored to plausible, high-stakes contexts, tax notices for individuals in Ukraine, payment notices for finance staff, and confidential event invitations for policy and research audiences. The reply-first structure also builds a false sense of legitimacy: because the victim initiated further contact, the follow-up archive feels expected rather than unsolicited.
Star Blizzard also used accounts created on compromised websites to send phishing emails, rather than relying mainly on free email services. This can make sender domains look more credible on cursory inspection, since the message may not originate from a known throwaway address.
Defenders and employees should treat any workflow where an email exchange leads to a password-protected archive as high risk, verifying the sender through a separate trusted channel before opening anything. Confidential invitations from reputable organizations should be independently confirmed rather than taken at face value. Because sending infrastructure can include compromised legitimate websites, sender domain reputation alone should not be treated as proof of legitimacy. Finally, unexpected tax, fine, or payment-related emails with attachments warrant verification through official channels before any file is opened.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
RedFlick is a malware delivery method that reduces victim interaction to a single step, using scheduled tasks to deploy the CosmicPulse backdoor after the target opens a password-protected archive.
The attacker waits for a recipient to reply to an initial email, then sends a follow-up with a password-protected ZIP or RAR file, with the password provided as an image to evade scanning.
Observed lures include Ukrainian-language tax audit or fine notices, English-language invitations to closed-door policy events, and payment advice notices targeting finance staff.
Targets include government and NGO staff, think tank and academic researchers, media, finance and accounts payable employees, and administrative staff who handle invitations.
Imagine this in your inbox: “Invitation to the Chatham House London Conference 2026 – 9 July 2026.” Looks legit, right? This is Star Blizzard’s new RedFlick trick: you reply first, then they send a password‑protected ZIP or RAR, with the password shown only in an image. One click, and RedFlick quietly drops the CosmicPulse backdoor. Same playbook shows up as Ukrainian tax notices: “Повідомлення про результати податкової перевірки” with an attached RedFlick lure. It might even come from a real-looking domain, because the account on that site was compromised. If an email wants you to reply first and then open a password‑protected attachment, stop. Before you open anything, verify the sender through a trusted channel you already use.
Microsoft reports Russia-linked Star Blizzard sent fake event invitations and other business notices to trick targets into opening disguised files that install a Windows backdoor. The campaigns targeted Ukraine-linked people and organizations and hit 100+ organizations, mainly in the U.S. and U.K.,…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
FortiGuard Labs reports an active phishing operation (“TTF Trap”) where emails posing as invoices, shipping documents, or business proposals deliver an archive that ultimately runs malware on Windows. The trick is a file ending in .ttf (TrueType font) that is actually a malicious script executed by…
Researchers observed a real phishing campaign that abused Microsoft 365’s Direct Send feature to make emails look like they came from the victim organization’s own domain, without compromising an employee account. The campaign was timed to mimic human sending patterns during U.S. Eastern business…
This roundup describes multiple real-world campaigns where attackers trick people into installing malicious software that looks legitimate (a fake Claude desktop app, a fake emergency alert app, and banking-malware phishing). The common pattern is “looks normal, feels urgent,” leading users to…
Researchers report real-world campaigns targeting European government and diplomatic organizations using diplomatic-themed Microsoft Word documents. Victims are prompted to click “Enable Content,” which runs malicious macros that install the HOOKEDGE backdoor and connect to webhook-based…
