Since January 2026, Microsoft has observed Russian state actor Star Blizzard evolve their detection evasion capabilities via large-scale phishing campaigns, the use of accounts on compromised websites, and a new malware delivery technique called RedFlick. msft.it/6010actya RedFlick can enable CosmicPulse malware installation after a single user interaction, reducing friction in the compromise process. Combined with the actor’s updated tactics, techniques, and procedures (TTPs), these changes improve Star Blizzard’s ability to reach more targets and increase the likelihood of successful compromise These developments reflect the actor’s continued efforts to streamline malware deployment and scale operations to support ongoing cyberespionage objectives. Get detections, indicators of compromise (IOCs), and hunting guidance from this Microsoft Threat Intelligence blog post.

Security & privacy used to mean fighting malware and hackers ...now, we have to add "AI agents" to that threat model 🤖 😅 Mahalo to the @nytimes for spotlighting some of our recent ChatGPT research & bugs! nytimes.com/2026/09/29/techn…

Today I'm joining Anthropic to lead the cybersecurity mission of the Frontier Red Team. In my career I've never seen a clearer opportunity to build a more secure world for everyone. For 40 years we've lived with fundamentally insecure technology. What will it take to make the past 40 years of hacking a historical oddity? That's what I'm here to find out. Super excited to work with @logangraham and the rest of the FRT crew.