Star Blizzard shifts to automated RedFlick attacks against Ukraine-linked targets
Russian state actor Star Blizzard has adopted a new malware delivery method called RedFlick to automate the installation of the CosmicPulse backdoor. This technique reduces the need for manual victim interaction compared to previous ClickFix campaigns. Microsoft reports that at least 13 large-scale phishing campaigns have impacted over 100 organizations, primarily in the US and UK, since January 2026.