Star Blizzard reportedly adopts RedFlick to reduce victim interaction in malware delivery

An automated chain after opening a disguised shortcut

According to the report, RedFlick begins with phishing messages leading to a password-protected archive containing a virtual disk and a shortcut disguised as a PDF.

Opening the shortcut reportedly launches commands that install scheduled tasks, retrieve later-stage payloads, and ultimately fetch and execute the CosmicPulse backdoor. Microsoft says it observed at least 13 large-scale phishing campaigns affecting more than 100 organizations since the start of 2026; the campaigns primarily affected organizations in the United States and the United Kingdom, while RedFlick campaigns targeted Ukrainian individuals and institutions and organizations supporting Ukraine.

The report describes RedFlick as a new delivery approach for Star Blizzard, not a newly invented cybersecurity technique. It contrasts the approach with the actor's ClickFix attacks, which required victims to take multiple manual actions.

Microsoft researchers say Star Blizzard has adopted RedFlick to automate more of its malware-delivery chain after a victim opens a malicious shortcut, reducing the victim interaction required compared with the actor's ClickFix attacks.

Fewer subsequent manual steps for the victim

The reported change is specific to Star Blizzard's delivery process: after the malicious shortcut is opened, the infection chain is designed to proceed with fewer manual steps from the victim. The report also describes separate scheduled tasks assigned to different stages of the chain.