Star Blizzard Expands Phishing Operations with RedFlick Technique

• •Star Blizzard has launched over 13 large-scale phishing campaigns since January 2026.
• •The new RedFlick technique allows malware deployment with just one user interaction.
• •Targeted organizations include NGOs, think tanks, and government entities, primarily in the U.S. and U.K.

Russian state-sponsored hacking group Star Blizzard has significantly escalated its phishing operations since January 2026, targeting over 100 organizations, primarily in the U.S. and U.K. The group has shifted from targeted spear-phishing to large-scale campaigns, employing a new malware delivery method called RedFlick. This technique requires only a single user interaction to deploy the CosmicPulse backdoor, making it easier to compromise victims. Star Blizzard has been observed using accounts created on compromised websites to send phishing emails, which typically include password-protected archives that conceal malicious payloads. The campaigns have affected various sectors, including NGOs, think tanks, and government institutions, with at least 13 distinct campaigns reported. The actor's tactics have evolved from earlier methods, such as ClickFix, to enhance their evasion capabilities and broaden their reach.