Microsoft reports that the Russia-linked group Star Blizzard expanded from small, highly targeted spear-phishing to larger “mass-mailing” email campaigns aimed at governments, think tanks, and nonprofits, especially those connected to Ukraine. The lures often promise exclusive events or warn about tax audits, payment notices, or fines, and the attack chain is designed to succeed with just one click from the victim.
Microsoft reported that Star Blizzard has expanded beyond narrowly targeted spear-phishing into larger mass-mailing campaigns, sending tens to hundreds of emails per operation. These messages typically impersonate an exclusive event organizer or a policy/NGO event host, inviting recipients to view details or RSVP through a single link. A second pretext leans on financial and compliance fear, warning of a supposed tax audit, payment notice, or fine to pressure quick action. In both cases, the attack chain is built so that only one click is needed to begin the compromise, reducing the number of steps a victim has to take before the attacker gains a foothold.
The campaigns worked because they combined scale with a low-friction infection flow. Microsoft observed activity at a volume not previously seen from this actor, and the requirement for only a single user interaction meant that even a brief moment of inattention could result in compromise. The lures also exploited two strong psychological triggers: the appeal of an exclusive opportunity and the anxiety created by financial or legal threats. Targeting government staff, think tank researchers, NGO leadership, and finance or accounts payable teams put the lures in front of people who routinely handle invitations, notices, and payment-related correspondence, making the pretexts feel plausible.
Organizations in government, nonprofit, think tank, and financial sectors, especially those connected to Ukraine-related work, should treat unexpected event invitations and financial compliance notices as verification triggers rather than click triggers. Staff should confirm event invitations through a known contact channel before clicking any link, and route unexpected tax, payment, or fine notices to finance or security teams for verification instead of acting on them directly. Because Microsoft noted that a single click can be enough to start the infection flow, awareness training should reinforce that clicking a link, not just entering credentials, carries real risk. Recognizing techniques mapped to spearphishing links (T1566.002), user execution via malicious links (T1204.001), and account compromise (T1656) can help defenders align detection and training priorities with how this activity actually unfolds.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Star Blizzard sends lures inviting recipients to exclusive events, or warning of tax audits, payment notices, and fines, to get a single click that starts the infection chain.
Microsoft observed targeting of governments, think tanks, NGOs, and financial institutions, particularly those connected to Ukraine, with impact seen across more than 100 organizations mainly in the U.S. and U.K.
Microsoft noted that the infection flow only requires a single user interaction, which reduces friction in the compromise process and increases the campaign's success rate.
Microsoft observed a shift from small, targeted spear-phishing to larger campaigns ranging from tens to hundreds of email messages per campaign, a scale not previously seen from this actor.
You get an email: “Invitation to an exclusive event.” Looks legit, right? That’s Star Blizzard’s new favorite trick. Microsoft says Star Blizzard scaled up from a few spear-phishing emails to mass campaigns, tens to hundreds at a time, offering VIP events or warning about tax audits, payment notices, and fines. Here’s the scary part: their RedFlick infection flow only needs a single click. You don’t have to type a password, just hitting that RSVP or “view audit details” link can be enough to compromise you. If you get an unexpected “exclusive event” or scary tax or payment notice, don’t click anything, forward it to the security team and let us check it first.
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
China-linked actor UTA0565 sent phishing emails that pushed recipients to click spoofed links to fake media/NGO websites. Visiting the sites triggered a Chrome-to-Windows zero-day exploit chain that escaped the browser sandbox and installed CLEANGULP malware for remote control.
Researchers say a China-aligned group (UTA0565) sent phishing emails to government targets and used multiple fake websites to lure victims into visiting pages that triggered a Chrome-and-Windows zero-day exploit chain. The messages used political advocacy themes and spoofed well-known organizations…
Anthropic says it disrupted a Russian state-linked campaign that used Claude to continuously rebuild malware when security tools detected it. The group (GTG-20006, linked to Midnight Blizzard/APT29) ran phishing and other human-targeted schemes, including device-code token theft against Microsoft…
Cisco Talos investigated a real incident at a Ukrainian government organization and found a complex WebDAV-based infection chain linked to a Russian actor (UAT-10820). The campaign uses fake CAPTCHA/verification prompts to manipulate users into copying and pasting commands, leading to credential…
Researchers say a Chinese-speaking cybercrime group compromised Brazilian government and education websites and used them as “trusted” entry points to quietly redirect visitors to attacker-run phishing pages. The fake pages impersonated well-known app stores (Google Play, Microsoft Store, Amazon)…
