RedFlick replaces ClickFix
Microsoft Threat Intelligence published research on 29 September 2026 describing RedFlick, which it tracks as a new malware delivery technique used by Star Blizzard. RedFlick starts a set of scheduled tasks that deploy the group's custom backdoor, CosmicPulse. Unlike the earlier ClickFix chains, which needed the victim to carry out several manual steps, the RedFlick infection flow needs only a single user interaction.
Microsoft observed at least 13 large-scale phishing campaigns using the technique between January and August 2026. They affected more than 100 organisations, primarily in the United States and the United Kingdom.
How the chain works
In the January campaigns, a password-protected ZIP held a VHDX virtual disk containing an LNK file disguised as a PDF, a hidden folder with a batch script, and a decoy PDF. Opening the LNK ran the batch script, which used SSH.exe to download and run a remote MSI installer. The MSI created a scheduled task that used control.exe to run a downloader disguised as a Control Panel applet (CPL).
Microsoft says this downloader is publicly known as NOROBOT or BAITSWITCH, names from Google Threat Intelligence Group's October 2025 reporting. It fetches two archives, stores an encrypted AES key in the registry and uses an embedded Python bootstrapper to decrypt and run CosmicPulse, which is also known as YESROBOT.
Later campaigns varied the chain. From April the MSI created three scheduled tasks, one of which sends host and user information to the command-and-control server and can run a remote DLL over WebDAV. In July the LNK used curl to download a PDF from which PowerShell extracted and ran a hidden Base64 payload, leading to another MSI and further scheduled tasks.
Targets
According to Microsoft, the targets include Ukrainian individuals and institutions, international NGOs, Western think tanks, governments, financial institutions, technology-sector organisations and diplomatic staff. The organisations affected were primarily in the US and UK.
The earliest campaigns, in January and February, targeted users of the Ukrainian email provider Ukr.net with lures impersonating Ukrainian authorities, such as tax audit and fine notifications. From March the lures moved to invitations and events, including messages themed around the IISS, the Atlantic Council and Chatham House, and later a payment advice note in August.
Earlier Star Blizzard operations impersonated political, diplomatic or academic figures using free email accounts. In 2026 Microsoft also saw the group send from accounts on compromised cPanel and WordPress sites, and some emails were made to look like internal communications from the targeted organisation.
Steganography and DarkSword
Microsoft says a campaign observed in mid-August 2026 used steganography to conceal identifiers. It gave no further detail.
The March campaign themed as an Atlantic Council closed-door discussion sent recipients a link to install the DarkSword iOS backdoor. Microsoft also cites a Proofpoint report from March on DarkSword targeting vulnerable Apple iOS devices.
About Star Blizzard
Star Blizzard, which Microsoft also tracks as SEABORGIUM, is a Russian state actor that conducts cyberespionage. CISA attributes it as subordinate to the Russian Federal Security Service (FSB) Centre 18. BleepingComputer describes the group as active since 2017.
Key points
- RedFlick replaces Star Blizzard's ClickFix chains with a flow that needs one user interaction and uses scheduled tasks to install CosmicPulse (also known as YESROBOT).
- The downloader in the chain is the one publicly known as NOROBOT or BAITSWITCH.
- Microsoft observed at least 13 large-scale campaigns from January to August 2026, affecting more than 100 organisations, primarily in the US and UK.
- The first campaigns targeted Ukr.net users with lures impersonating Ukrainian authorities; later ones used event and invitation themes.
- A mid-August campaign used steganography to conceal identifiers, and a March campaign pushed the DarkSword iOS backdoor.
Further reading & sources
- Star Blizzard refines phishing and malware delivery with the RedFlick technique | Microsoft Security Blog
- Russian state hackers use new RedFlick technique to push malware
- Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net
- Russian state actor Star Blizzard changes tactics with RedFlick malware chain