Star Blizzard QR Phishing

In mid-November 2024, Microsoft Threat Intelligence observed the Russian state-aligned threat actor Star Blizzard (a.k.a. SEABORGIUM, Callisto Group, TA446) using a new phishing technique. Instead of their traditional spear-phishing lures, Star Blizzard embedded weaponized QR codes in phishing documents to exploit WhatsApp’s device-linking feature. The phishing emails impersonated US government officials, offering recipients the opportunity to join a WhatsApp group related to Ukraine NGOs. The initial email contained a broken QR code, designed to elicit a response. A follow-up email then delivered a shortened link that redirected to a fake WhatsApp Web page. Victims scanning the QR code effectively linked their WhatsApp account to the attacker’s device, enabling Star Blizzard to monitor conversations and exfiltrate data.

- Account Takeover: Successful scans of the malicious QR code gave Star Blizzard persistent access to victims’ WhatsApp accounts. - Message Exfiltration: Attackers could silently monitor conversations and export entire chat histories using WhatsApp Web plugins. - Impersonation & Social Engineering: Compromised WhatsApp accounts could be misused to impersonate trusted contacts, spread disinformation, or deliver follow-on phishing payloads. - Intelligence Collection: Victims included diplomats, government officials, defense researchers, and NGOs supporting Ukraine — providing attackers access to sensitive political and operational discussions.