Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Star Blizzard fake event-invitation phishing campaign

Campaign
First reported
Last updated
Happening score
H score 29
2 unique sources, 2 articles

Summary

Hide ▲

Star Blizzard is using the RedFlick delivery chain in 2026 to push the CosmicPulse backdoor through phishing emails and a password-protected archive that leads to a hidden infection sequence. Microsoft says the campaign has targeted Ukraine-linked individuals and institutions and also international NGOs, think tanks, governments, and financial institutions supporting Ukraine. Since January, the operation has affected more than 100 organizations, and Microsoft says it has seen at least 13 distinct large-scale phishing campaigns this year. The new delivery method relies on a disguised shortcut, multiple scheduled tasks, and NOROBOT/BAITSWITCH to automate infection and reduce victim interaction.

Related Happenings

UAT-11587 Antino spear-phishing campaign against government and policy organizations

Campaign
H score22 First: 02.10.2026 20:33 Last: 02.10.2026 20:33 Sources 1

About this happening: A UAT-11587 spear-phishing campaign is expanding across Asia and Syria, delivering the Antino backdoor to government and policy organizations and increasing th...

Open Happening

Antino Windows backdoor activity using Microsoft 365 dead drops

Malware Activity
H score15 First: 02.10.2026 20:33 Last: 02.10.2026 20:33 Sources 1

About this happening: Antino is being deployed as a Windows backdoor that gives operators host reconnaissance, command execution, file transfer, and persistence while routing C2...

Open Happening

CSuite phishing campaign stealing Microsoft 365 sessions and deploying remote-access tools

Campaign
H score30 First: 30.09.2026 13:45 Last: 30.09.2026 13:45 Sources 1

About this happening: The CSuite phishing campaign is stealing Microsoft 365 sessions and deploying ScreenConnect or Action1, creating paths to account takeover, endpoint control, and b...

Open Happening

GTG-30006 Claude-assisted malware and phishing pipeline

Malware Activity
H score20 First: 11.09.2026 17:29 Last: 11.09.2026 17:29 Sources 1

About this happening: An Iranian actor, GTG-30006, used Claude.ai to build malware, a delivery pipeline, and a phishing portal targeting domestic Iranians, increasing the risk of ...

Open Happening

UNC7005 (Storm-2945) targeted OAuth and WhatsApp phishing campaign

Campaign
H score16 First: 20.08.2026 22:59 Last: 20.08.2026 22:59 Sources 1

About this happening: A UNC7005 (Storm-2945) campaign is hijacking accounts with OAuth, WhatsApp linking, and device-code phishing across academia, diplomatic, nonprofit, and Euro...

Open Happening

Timeline

  1. 29.09.2026 20:20 2 articles · 13d ago

    Atlantic Council-themed emails lead recipients to DarkSword

    Technical Analysis Update

    People who replied to an Atlantic Council-themed invitation were sent a link to DarkSword, an iPhone exploit kit, instead of the Windows backdoor. Trellix found four such emails on March 26 and said confidence was medium because the exploit pages were offline and no exploit code was recovered.

    Show sources
    Open in new tab
  2. 29.09.2026 20:20 2 articles · 13d ago

    Star Blizzard phishing campaign affects more than 100 Ukraine-linked organizations

    Initial Disclosure

    Microsoft says Star Blizzard has been using fake event invitations to deliver a Windows backdoor to people and organizations tied to Ukraine, with more than 100 organizations affected since January and at least one computer infected. Since March, the campaigns have used email accounts on WordPress and cPanel websites, and Microsoft published hunting queries and indicators on September 29.

    Show sources
    Open in new tab