RedFlick Malware: How Phishing Attacks Deliver Malware and How Organizations Can Defend Against Them

Cyber threats continue to evolve as attackers develop increasingly sophisticated methods to compromise business systems. Rather than relying solely on malicious links or infected attachments, threat actors are combining social engineering, legitimate operating system features, and multi-stage malware delivery techniques to evade security controls.

One example is RedFlick, a malware delivery technique reported in connection with Star Blizzard, a threat group linked to Russian state-sponsored cyber operations. The technique uses phishing emails, disguised shortcut files, and Windows scheduled tasks to initiate a sequence of activities that can ultimately lead to the deployment of a backdoor.

For organizations, this type of attack highlights an important cybersecurity challenge: a single user action may trigger multiple stages of malicious activity that are not immediately visible.

Understanding how RedFlick works can help IT teams and security professionals identify potential attack indicators, strengthen endpoint protection, and improve their incident response capabilities.

What Is RedFlick?

RedFlick is the name used to describe a malware delivery technique reported in cybersecurity research involving the Star Blizzard threat group.

The technique begins with phishing emails designed to persuade recipients to open an attachment. The attack then uses files and operating system mechanisms to execute commands, download additional components, and deploy malware on the targeted system.

Rather than relying on a single malicious executable, this approach distributes the attack across multiple stages. Each stage performs a specific function, making it important to investigate the entire sequence rather than focusing on an individual file.

Key components associated with this attack pattern include:

• Phishing emails: Messages designed to convince recipients to open attachments or take other actions.

• Malicious shortcut files: Windows shortcut files disguised as legitimate documents, such as PDFs.

• Scheduled tasks: A legitimate Windows feature that attackers can abuse to execute programs or commands.

• Multi-stage malware delivery: A process in which successive components download or launch additional malicious payloads.

• Backdoor malware: Malicious software that can provide attackers with remote access or command-execution capabilities, depending on its functionality.

The combination of these techniques demonstrates why effective cybersecurity requires visibility across email, endpoint activity, and network communications.

How Does the RedFlick Attack Work?

Understanding the attack sequence helps organizations identify where preventive and detective controls should be applied.

1. Phishing Emails Establish the Initial Entry Point

The attack begins with a phishing email designed to appear relevant or trustworthy. For example, the message may contain an invitation to an event or other content that encourages the recipient to open an attachment.

Attackers may use familiar business contexts, convincing language, or misleading sender information to increase the likelihood of user interaction.

Because these messages can resemble legitimate business communications, organizations should not rely on users identifying suspicious emails through visual inspection alone.

2. Malicious Attachments Initiate the Attack

In the reported RedFlick campaign, attackers used password-protected archive files containing a virtual hard disk file in VHDX format.

The disk image contained a shortcut file designed to resemble a PDF document. When opened, the shortcut could execute commands in the background while presenting a decoy document to distract the user.

This technique illustrates how a seemingly ordinary file-opening action can trigger activity that extends beyond displaying a document.

Organizations should therefore pay particular attention to unexpected archives, unfamiliar file types, and files that execute commands or launch other programs.

3. Windows Scheduled Tasks Support Further Execution

Windows Scheduled Tasks are a legitimate operating system feature used to run programs or commands according to predefined schedules and conditions.

However, attackers can abuse this functionality to automate malicious activity, launch additional components, or maintain execution across different stages of an attack.

In the reported campaign, multiple scheduled tasks were created with names resembling legitimate system maintenance activities.

This creates a detection challenge: a task name may appear harmless even when its associated command, executable, or behavior is suspicious.

Security teams should investigate scheduled tasks alongside process execution records, file locations, user context, and relevant Windows event logs.

4. Additional Malware Components Are Downloaded

After the initial execution stage, additional components may be downloaded and launched to continue the attack.

The reported campaign involved malware components identified as NOROBOT and BAITSWITCH, which were associated with the delivery of the CosmicPulse backdoor.

The backdoor can support further operations on a compromised system, depending on the capabilities of the deployed payload.

Once malicious code is running, the potential consequences extend beyond the original phishing email. Attackers may attempt to access information, execute additional commands, or expand their access within the affected environment.

The actual impact depends on the malware's capabilities, the privileges available to the attacker, and the organization's existing security controls.

RedFlick vs. ClickFix: What Is the Difference?

RedFlick and ClickFix both illustrate how social engineering can initiate malware execution, but they use different approaches to involve the victim.

The distinction is important because security awareness training should address more than suspicious links. Employees also need to recognize unexpected attachments, deceptive documents, and instructions that ask them to run commands or change system settings.

Technical controls should complement this training to reduce dependence on user judgment alone.

What Are the Potential Risks of RedFlick to Organizations?

If an attacker successfully deploys malware and gains access to a business system, several risks may arise. The extent of the impact depends on the compromised device, the privileges obtained, and the attacker's objectives.

1. Unauthorized Access to Business Information

Attackers may attempt to access business documents, customer information, internal communications, or other sensitive data available from a compromised system.

The potential exposure depends on the information stored on the device and the user's access permissions.

2. Further Compromise Through Backdoor Access

Backdoor malware may allow attackers to execute commands or introduce additional malicious components.

If the compromised system has access to important business applications or shared resources, the incident may require a broader investigation to determine whether other systems have been affected.

3. More Complex Detection and Investigation

Multi-stage attacks can generate activity across different processes, files, scheduled tasks, and network connections.

Investigating only the initial attachment may leave other malicious components undiscovered. Security teams need to correlate endpoint telemetry, email records, and network activity to establish the attack timeline and determine the scope of compromise.

4. Business Disruption and Recovery Costs

A security incident may require affected devices to be isolated, systems to be investigated, and business applications to be restored.

Depending on the severity of the incident, organizations may experience operational disruption, additional recovery costs, and potential reputational damage.

7 Ways to Protect Your Organization Against RedFlick and Similar Malware Attacks

No single security product can eliminate every cybersecurity risk. Organizations should adopt a layered defense strategy that combines preventive controls, behavioral detection, user awareness, and incident response.

1. Strengthen Email Security

Deploy email security controls that help identify phishing messages, malicious attachments, suspicious URLs, and other email-borne threats.

Depending on business requirements, relevant capabilities may include attachment analysis, URL filtering, anti-malware inspection, and detection of emerging threats.

Organizations should also establish clear procedures for reporting suspicious messages and reviewing potentially malicious attachments.

2. Use EDR to Detect Suspicious Endpoint Activity

Endpoint Detection and Response (EDR) solutions provide visibility into activity on endpoints, helping security teams investigate potentially malicious behavior.

Relevant indicators may include:

• Unexpected process execution from unusual directories.

• Suspicious command-line activity.

• Unusual creation or modification of scheduled tasks.

• Unexpected execution of scripts or DLLs.

• Connections to unfamiliar external destinations.

Detection capabilities vary by product and configuration. Organizations should ensure that endpoint monitoring policies are appropriately configured and that detected threats can be investigated and contained.

3. Monitor Windows Scheduled Tasks

IT and security teams should periodically review scheduled tasks, particularly those that have recently been created or modified.

Investigations should consider:

• The task's creation time and associated user account.

• The executable or command being launched.

• The file's location and digital signature, where applicable.

• Related process activity and network connections.

• Whether the task matches an approved administrative or software deployment activity.

A suspicious name alone does not prove malicious activity. Context and supporting evidence are essential when determining whether a task is legitimate.

4. Apply Least Privilege and Strong Identity Controls

Restrict administrative privileges to users who genuinely require them. Limiting unnecessary permissions can reduce the potential impact of a compromised account.

Organizations should also implement multi-factor authentication (MFA) for important accounts and consider phishing-resistant authentication methods, such as passkeys or FIDO2 security keys, where appropriate.

Identity security is especially important when attackers attempt to use compromised credentials to access additional systems.

5. Improve Cybersecurity Awareness Training

Employees should understand how phishing attacks work and how to recognize suspicious attachments, unexpected archives, deceptive file names, and unusual requests.

Cybersecurity Awareness Training can be reinforced through phishing simulations and regular communications tailored to the organization's risk profile.

Employees should also know how to report suspicious activity promptly without fear of blame, enabling security teams to investigate potential incidents earlier.

6. Improve Security Monitoring and Threat Detection

Collecting and correlating security telemetry from endpoints, email systems, firewalls, and other important infrastructure can help organizations identify relationships between seemingly unrelated events.

Security monitoring should include appropriate alert prioritization, investigation procedures, and escalation paths.

Where suitable, organizations can integrate endpoint detection with broader security monitoring capabilities to improve visibility and support incident investigation.

7. Prepare an Incident Response and Recovery Plan

Organizations should establish documented procedures for handling suspected malware infections.

These procedures should address:

• Isolating affected endpoints when appropriate.

• Preserving evidence for investigation.

• Identifying the initial entry point and scope of compromise.

• Removing malicious components and addressing the underlying cause.

• Reviewing potentially compromised credentials.

• Restoring systems from trusted sources and validated backups.

• Monitoring affected systems after recovery.

Incident response plans should be tested periodically so that IT, security, and business stakeholders understand their responsibilities during an actual incident.

How BigFishTec Can Help Strengthen Your Cybersecurity Defenses

Threats such as RedFlick demonstrate why organizations need a coordinated cybersecurity strategy that addresses email security, endpoint protection, threat detection, and employee awareness.

BigFishTec provides cybersecurity services designed to help organizations assess their security needs and strengthen their defenses in line with their business requirements.

Relevant service areas include:

Cybersecurity Solution Design, Implementation, and Maintenance

Develop and maintain security solutions that align with an organization's infrastructure, operational requirements, and risk profile.

Cybersecurity-as-a-Service (CSaaS)

Support ongoing cybersecurity protection and management through service models designed around an organization's security needs.

Cybersecurity Assessment and Penetration Testing

Identify security weaknesses and evaluate the effectiveness of existing controls through structured assessments and authorized security testing.

Cybersecurity Awareness Training

Help employees understand phishing, social engineering, and other common attack techniques while building safer security practices across the organization.

The appropriate combination of services depends on the organization's existing security architecture, exposure, regulatory requirements, and available resources.

Strengthen your organization's cybersecurity posture with BigFishTec.

Contact BigFishTec to discuss your cybersecurity requirements and explore solutions aligned with your business needs.

Website: https://www.bigfishtec.com/

Frequently Asked Questions About RedFlick

What is RedFlick malware?

RedFlick is the name used for a malware delivery technique described in cybersecurity reporting. It should be distinguished from the individual malware components delivered during the attack, which may have different names and functions.

How does RedFlick infect a computer?

The reported attack begins with phishing emails and malicious attachments. A disguised shortcut file can initiate background commands, followed by additional execution stages that may deliver malware to the targeted system.

Can antivirus software prevent RedFlick attacks?

Antivirus can help detect and block known malicious files and other threats, but effectiveness depends on the product, configuration, and attack characteristics. Organizations should complement antivirus with EDR, email security, identity controls, and security monitoring.

How can organizations detect suspicious scheduled tasks?

Organizations can review newly created or modified scheduled tasks, inspect the commands and executables they launch, and correlate this information with process activity, Windows event logs, and endpoint security alerts.

What should an organization do if a RedFlick infection is suspected?

The organization should notify its IT or security team, investigate the affected endpoint, and follow its incident response procedures. Appropriate actions may include isolating the device, preserving evidence, identifying the scope of compromise, and restoring the system only after the threat has been addressed.

Conclusion

RedFlick highlights how phishing attacks can combine social engineering, legitimate Windows functionality, and multi-stage malware delivery to compromise business systems.

Organizations should look beyond email filtering alone and adopt a layered security approach that includes Email Security, Endpoint Detection and Response, identity protection, employee awareness, and incident response.

By improving visibility across systems, monitoring suspicious behavior, and preparing effective recovery procedures, organizations can strengthen their ability to prevent, detect, and respond to evolving cyber threats.

Need help strengthening your organization's cybersecurity defenses? Contact BigFishTec to explore a security strategy tailored to your business.