Star Blizzard refines phishing and malware delivery with the RedFlick technique

What is being reported

Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malwa…

Why defenders should review it

Current threat reporting can affect exposure management, detection priorities, third-party risk, and incident readiness. Relevance depends on your assets, geography, industry, and control environment.

Defensive review checklist

1. Verify the report with the original publisher and identify whether affected products or services exist in your environment.
2. Review identity logs, strengthen phishing-resistant MFA, revoke suspicious sessions, and notify users with specific indicators.
3. Hunt for published indicators, isolate suspected systems, preserve evidence, and verify recoverable offline backups.
4. Record decisions, evidence, owners, and deadlines in the incident or vulnerability-management system.

Evidence and attribution

Raven Academy has not independently validated this event. Treat attribution, victim counts, exploit status, and impact as claims from the named publisher until corroborated.