Recent searches
Search options
@Olly42@nerdculture.deRussian Star Blizzard targets WhatsApp Accounts in new Spear-Phishing Campaign.
The cat-and-mouse game between state-sponsored Russian threat actor group’s and one of the world’s biggest technology companies has continued into 2025.
![It all starts with a spear-phishing email that purports to be from a U.S. government official to lend it a veneer of legitimacy and increase the likelihood that the victim would engage with them.
The message contains a quick response (QR) code that urges the recipients to join a supposed WhatsApp group on "the latest non-governmental initiatives aimed at supporting Ukraine NGOs." The code, is deliberately broken so as to trigger a response from the victim.
Should the email recipient reply, Star Blizzard sends a second message, asking them to click on a t[.]ly shortened link to join the WhatsApp group, while apologizing for the inconvenience caused. "When this link is followed, the target is redirected to a web page asking them to scan a QR code to join the group," Microsoft explained. "However, this QR code is actually used by WhatsApp to connect an account to a linked device and/or the WhatsApp Web portal."
<https://faq.whatsapp.com/1317564962315842/?cms_platform=web>
In the event the target follows the instructions on the site ("aerofluidthermo[.]org"), the approach allows the threat actor to gain unauthorized access to their WhatsApp messages and even exfiltrate the data via browser add-ons.](https://nerdculture.de/system/media_attachments/files/113/860/748/225/877/438/original/069d44f0cf010b41.jpeg "It all starts with a spear-phishing email that purports to be from a U.S. government official to lend it a veneer of legitimacy and increase the likelihood that the victim would engage with them.
The message contains a quick response (QR) code that urges the recipients to join a supposed WhatsApp group on \"the latest non-governmental initiatives aimed at supporting Ukraine NGOs.\" The code, is deliberately broken so as to trigger a response from the victim.
Should the email recipient reply, Star Blizzard sends a second message, asking them to click on a t[.]ly shortened link to join the WhatsApp group, while apologizing for the inconvenience caused. \"When this link is followed, the target is redirected to a web page asking them to scan a QR code to join the group,\" Microsoft explained. \"However, this QR code is actually used by WhatsApp to connect an account to a linked device and/or the WhatsApp Web portal.\"
<https://faq.whatsapp.com/1317564962315842/?cms_platform=web>
In the event the target follows the instructions on the site (\"aerofluidthermo[.]org\"), the approach allows the threat actor to gain unauthorized access to their WhatsApp messages and even exfiltrate the data via browser add-ons.")