There's a comfortable fiction in a lot of security programmes: that attacks arrive from obviously bad places. Dodgy domains registered last Tuesday, newly minted TLDs, infrastructure that lights up a threat feed the moment it's queried. Build reputation-based controls, score the sender, block the ugly stuff, move on. Microsoft's latest reporting on Star Blizzard — a Russian state actor with a long history of credential phishing against government, defence, NGO and journalism targets — is another reminder that the fiction is just that.

What the report actually says

Here is what Microsoft reports. Since January 2026, Microsoft has observed Star Blizzard evolving their detection evasion through large-scale phishing campaigns, the use of accounts on compromised legitimate websites, and a novel malware delivery technique Microsoft tracks as RedFlick. The full technical detail sits in the Microsoft Security Blog post linked at the end; read it directly rather than treating anyone's summary, including this one, as the operational source of truth.

What I want to talk about is the shape of it, because the shape is familiar and the shape is what you plan against.

Compromised legitimate sites are the quiet part

Of the three elements in that report, the one that should concern defenders most is the use of accounts on compromised websites. Not novel — far from it — but durable, and it quietly defeats an entire class of control.

Think about what a compromised, otherwise-reputable host gives an attacker. A domain with age and history. Valid TLS, often from a provider nobody would blink at. A clean reputation score in your secure email gateway, your proxy and your DNS filter. Possibly an inbound allow-list entry, if someone in the business once needed it. The link looks fine because, in every mechanical sense your tooling cares about, it is fine. The malicious part is the content, not the carrier.

This is why I'd argue domain reputation should be treated as a weak signal that reduces volume, not a control you lean on. It's good at filtering the lazy ninety-odd percent. It is structurally incapable of catching an adversary who is willing to spend a little effort acquiring someone else's good name.

"State-sponsored" does not mean exotic

There's a persistent assumption that nation-state tradecraft means zero-days and kernel implants, and that credential phishing is beneath a serious actor. Star Blizzard has spent years demonstrating the opposite. Patient reconnaissance, convincing pretexts, impersonation of people the target actually knows, and a login page that looks right. The sophistication is in the targeting and the social engineering, not the exploit.

That matters for how you spend. If your threat model for state actors drives investment into exotic endpoint telemetry while your identity controls still permit password-plus-SMS for a researcher who talks to foreign journalists, you have mismatched your defence to your adversary. The most capable teams in the world will use the cheapest thing that works, and the cheapest thing that works is still a convincing email.

What to actually do about it

Nothing here is new advice, which is rather the point — the controls that blunt this are the ones that have been on the list for years and still aren't universally deployed.

  • Phishing-resistant MFA for anyone plausibly targeted. FIDO2 security keys or passkeys bound to the origin. A proxied credential-harvesting page cannot replay what it cannot obtain. If you're still on push notifications or TOTP for high-risk users, that's your single highest-value change.
  • Treat link reputation as advisory. Detonation, time-of-click rewriting and content inspection matter more than domain age when the carrier is a hijacked legitimate site.
  • Constrain initial execution. Whatever shape a given delivery technique takes, the endpoint controls that matter are consistent: application control or WDAC where feasible, attack surface reduction rules in enforce rather than audit mode, script host restrictions, and blocking the usual LOLBin chains.
  • Hunt on identity, not just endpoint. Impossible travel, unfamiliar sign-in properties, new OAuth consent grants, mailbox forwarding rules and inbox rule creation. Credential phishing succeeds quietly; the first durable evidence is usually in sign-in and audit logs.
  • Know who your high-risk users are. Not by job title — by who they talk to and what they hold. Policy tiers should follow exposure.

The naming problem, briefly

Microsoft has given this delivery technique a name: RedFlick. Vendor nomenclature serves a purpose — it gives detection engineers a shared handle — but it also creates a reflex I'd push back on. A named technique is not a named control gap. The useful question isn't "are we protected against RedFlick?" It's "which of our controls sit downstream of this delivery path, and would any of them have fired?"

Map the reported behaviours to your own ATT&CK coverage, check whether the relevant telemetry is actually being collected and retained, and confirm the detection would survive a minor variation in the technique. Named-threat panic tends to produce a point fix for one variant and no improvement in the class.

What I'd do in the next fortnight

Read the Microsoft post properly and extract the indicators and behavioural detections. Then do three unglamorous things. Check which of your high-exposure accounts still lack phishing-resistant MFA, and fix the list rather than writing a paper about it. Pull your sign-in logs for the relevant period and look for the behavioural patterns, not just the IOCs — infrastructure rotates, behaviour is stickier. And review how much weight your mail and web filtering places on domain reputation alone, because that is precisely the assumption this campaign is built to exploit.

The uncomfortable conclusion from reporting like this is that the adversary's improvement cycle is measured in weeks and ours is often measured in change advisory board meetings. You won't close that gap with a new product. You close it by making the handful of controls that genuinely break the attack chain universal rather than aspirational.

Source: Star Blizzard refines phishing and malware delivery with the RedFlick technique