Star Blizzard RedFlick: Atlantic Council-themed phishing lure with iOS install-profile link (DarkSword)
Detects phishing emails themed around Atlantic Council invitations that contain links attempting to lure users into installing iOS configuration profiles, often associated with malicious backdoors like DarkSword, attributed to the Star Blizzard (G1033) threat group.
Microsoft Sentinel (KQL)

