Threat Actor Activity11d ago·4 sources
Star Blizzard swaps ClickFix for RedFlick to deliver its CosmicPulse backdoor
Microsoft reports that Star Blizzard, a Russian state actor that CISA attributes to FSB Centre 18, has replaced its multi-step ClickFix chains with RedFlick, a delivery technique that needs a single user interaction and uses scheduled tasks to deploy the CosmicPulse backdoor. At least 13 campaigns since January 2026 affected more than 100 organisations, primarily in the United States and United Kingdom.
Star BlizzardRedFlickCosmicPulse+3
