RedFlick is a named delivery technique used in Microsoft’s analysis of a phishing campaign set. In this context, “delivery” means the steps used to get a malicious message, link, or payload in front of a target and to start the attack chain. The label does not describe a specific piece of malware by itself; it refers to the method and workflow behind the delivery.
It matters because delivery techniques often determine how scalable and reliable a phishing operation is. If a campaign can trigger more of its attack path with less user interaction, defenders have fewer chances to stop it after the initial lure. In real environments, that can look like an email that appears routine, followed by automated redirects, prompts, or other low-friction steps that move the target toward credential theft or further compromise. Defenses include strong mail filtering, multi-factor authentication, user training, and monitoring for unusual follow-up activity after a message is opened.