For years, a lot of phishing advice has boiled down to “Don’t click the link.” But attackers are getting better at reducing the amount of work they need somebody to do.
A recent campaign linked to the Russian state-backed group Star Blizzard is a good example.
Microsoft has been tracking a new technique called RedFlick. It replaces some of the group’s previous ClickFix-style attacks, where the victim might have been asked to perform several unusual steps before malware could be installed.
RedFlick can reduce that to a much simpler interaction.
What has changed?
Some ClickFix attacks work by persuading somebody to do something they would not normally do.
They might be shown a fake error message and told to:
copy some text
open the Windows Run box
paste a command
press Enter
There are several opportunities during that process for somebody to think, “Hang on. Why am I doing this?”
RedFlick reduces some of that friction. In examples analysed by Microsoft, victims received password-protected ZIP or RAR files containing what appeared to be a document. Behind the scenes, opening the malicious file could start a chain using legitimate Windows tools and scheduled tasks to eventually install the attacker’s malware.
Microsoft describes the newer attack flow as requiring only a single user interaction, compared with the multiple steps used in earlier ClickFix campaigns.
In plain English: The attacker is trying to make the dangerous action look more like an ordinary action.
They are casting a wider net too
There is another important change. Star Blizzard has historically been associated with carefully researched spear-phishing attacks against specific people.
Microsoft says that during 2026 it has also moved towards much larger phishing campaigns.
Dark Reading reports that Microsoft has observed 13 large-scale campaigns since January, primarily targeting NGOs, think tanks and government organisations. Some campaigns involved hundreds of messages rather than concentrating on a handful of carefully selected individuals.
The emails can impersonate tax authorities, financial organisations, respected think tanks and event organisers.
Microsoft has even seen emails designed to look like internal messages coming from the recipient’s own organisation.
We are seeing more attacks generally that rely on trust, rather than obviously suspicious emails from obviously suspicious addresses.
A message from somebody you recognise is naturally more convincing.
Especially when their account has genuinely been compromised.
Does this mean Star Blizzard is coming after every small business?
No. The campaigns Microsoft describes are focused on organisations and individuals linked to Ukraine, government, policy, NGOs and related areas.
But the technique is worth paying attention to because the underlying lesson applies much more widely.
If you don’t need ZIP and RAR files, why allow them?
This attack also raises a very simple security question. Do your staff actually need to receive ZIP or RAR files by email?
For plenty of organisations, the answer will be very rarely or even never.
If that is the case, consider blocking them at the email gateway or within Exchange Online rather than relying on every recipient to decide whether an archive is safe.
That will not stop every phishing attack, but it removes one route an attacker can use.
It is a good example of proportionate security: If the business doesn’t need something, don’t leave it open just because it is there.
Before blocking archive files completely, check whether any genuine business processes rely on them. Some suppliers, payroll systems or specialist applications may still use compressed attachments.
If they are needed occasionally, you could consider a controlled alternative such as an approved file-sharing service rather than allowing archive attachments into everybody’s inbox by default.
Email security should do more than basic spam filtering
Microsoft 365 provides useful protection, but organisations handling sensitive information or facing regular phishing attempts should consider what happens when a more convincing message gets through.
We use Check Point Harmony Email Security, formerly Avanan, as an additional layer for a number of our customers.
Rather than relying purely on basic spam filtering, platforms like this can analyse things such as:
suspicious attachments
malicious links
impersonation
unusual sender behaviour
account compromise
phishing techniques that initially appear legitimate
The point is to stop as much as possible before the person ever has to make a decision.
That is particularly important as attackers get better at making malicious emails look ordinary.
The click shouldn’t be the end of your security
This is why I don’t like treating people as the weakest link. People are busy. They receive dozens or hundreds of emails. Attackers deliberately create messages that look familiar, urgent or completely routine.
We should absolutely help people recognise suspicious behaviour and make it easy for them to report something that doesn’t feel right.
But our entire cyber security strategy cannot depend on a person identifying every convincing attack correctly.
There should be layers around them.
Better email protection
Stop as much malicious content as possible before it reaches the person.
That can include stronger phishing detection, attachment analysis, link analysis and sensible policies about the types of files your organisation actually needs to receive.
If ZIP and RAR files have no legitimate business purpose, block them.
Strong authentication
Microsoft recommends phishing-resistant authentication and stronger access controls such as Conditional Access.
Passkeys and hardware security keys can make stealing a password far less useful to an attacker.
Endpoint detection and response
If something malicious does run, endpoint security needs to spot what happens after the click.
Microsoft recommends EDR in block mode as one of the protections against this campaign.
That could mean identifying unusual processes, suspicious scheduled tasks, malicious scripts or other behaviour that does not belong on the device.
This is where MDR can add another layer too: not just detecting suspicious behaviour, but having somebody investigate it and respond.
Reduce what software is allowed to run
Application control can reduce the opportunity for unexpected software, scripts or installers to execute in the first place.
Not every employee needs the ability to run everything.
Monitor identities as well as devices
Many modern attacks are aimed at the account rather than the laptop.
Identity threat detection and response can help identify suspicious sign-ins, unusual changes and other signs that an account may have been compromised.
Make reporting easy
If somebody clicks something and immediately thinks: “That didn’t look right.” you want them telling you quickly. No blame. No lecture.
A five-minute head start can make a huge difference when somebody is investigating an incident.
What happens after the click in your organisation?
Black Swan Cyber Security Solutions helps small and micro businesses put sensible security layers around email, identities and devices – without the enterprise jargon or unnecessary complexity.
If you’d like to understand where the gaps are, book a free cyber security review.
