Summary
Microsoft and multiple national CERTs have published coordinated research documenting RedFlick, a new phishing technique deployed by APT29 (Midnight Blizzard, Cozy Bear) in a campaign targeting more than 100 organizations across government, defense, think tanks, and non-governmental organizations. RedFlick is a variant of HTML smuggling that reconstructs a malicious payload inside the victim’s browser using encoded JavaScript, bypassing email security gateways and file attachment scanning. The decoded payload delivers WINELOADER, APT29’s modular backdoor previously documented in campaigns targeting European diplomatic missions.
Timeline
| Date | Event |
|---|---|
| August-September 2026 | RedFlick campaign targeting 100+ organizations; Microsoft and national CERTs investigate |
| Sep 29, 2026 | Microsoft and CERTs publish coordinated disclosure; BleepingComputer and CybersecurityNews report |
What Happened
RedFlick is a refinement of HTML smuggling in which a malicious payload is embedded in an HTML page as encoded data. When the victim opens the HTML file, JavaScript decodes the payload and triggers a browser download without the payload ever traversing the network as a recognizable malicious file. Email security gateways cannot detect the payload because at the point of scanning it does not exist as a file — it exists as encoded data inside what appears to be an HTML document.
APT29’s RedFlick variant introduces additional obfuscation: multiple encoding layers and code splitting across inline scripts to defeat static analysis, with the decoded payload delivered as a password-protected archive whose password appears in the phishing lure. The payload is WINELOADER, a modular backdoor establishing persistence via encrypted HTTPS C2 channels that mimic legitimate traffic. WINELOADER has been previously attributed exclusively to APT29 and observed in campaigns targeting the German Social Democratic Party, European diplomatic missions, and defense sector organizations.
Note on Domain Intelligence
APT29 does not operate legitimate clearnet infrastructure. No single victim domain is the primary subject of this bulletin.