On July 13, 2026, JPCERT/CC published an update reporting that the Chinese-speaking threat group APT-C-60 has continued and modified its spear-phishing campaigns against Japanese organizations (JPCERT/CC had previously documented the group in December 2024 and November 2025). Compared with the 2024-2025 campaigns (VHDX distributed via Google Drive or direct email attachment, executed through a Git binary), the 2026 chain uses a RAR archive containing an LNK file as the delivery vehicle, and the distribution infrastructure has been expanded from GitHub/Bitbucket to also include GitLab, jsDelivr and Codeberg.

The 2026 attack chain begins with a spear-phishing email containing a Proton Drive link that lures the victim into downloading a RAR file (e.g. the Japanese-named archive '具体的内容.rar'). A similar case was confirmed where the malicious file was attached directly to the email without the Proton Drive intermediary. The archive extracts to files including an LNK shortcut (e.g. '利権癒着の具体的内容.lnk', 'desk.lnk', 'idx2.lnk', 'information.lnk', 'ipo6.lnk'). When opened, the LNK copies itself and uses the legitimate Windows binary mshta.exe to execute JavaScript embedded within the LNK file (obfuscated). The embedded JavaScript downloads 'contributing[1].txt' from the jsDelivr CDN, searches for/decodes/extracts the downloaded file, then uses the legitimate git.exe from the extracted folder to execute a script stored in the same folder. The script builds and runs a downloader by combining .db files (e.g. TMI003.db, TMI100.db, TMI210.db, TMI320.db, TMI400.db) extracted from the archive. The downloader then accesses the legitimate developer services GitHub, GitLab, jsDelivr and Codeberg to download and execute additional staged downloaders and loaders, culminating in the SpyGlace backdoor (versions v3.1.15, v3.1.17 and v3.1.18 observed; JPCERT/CC identified no major functional differences compared with earlier versions).

The abuse of legitimate services is deliberate: by using developer-oriented services and CDNs that are often allowed in corporate environments, the actor makes communications and downloads appear to be normal access, making detection/blocking by destination alone difficult. Infrastructure recovered from the campaign includes seven C2 IPs, the jsDelivr URL cdn.jsdelivr.net/gh/mei1990789/class125/ (referencing the attacker repository github.com/mei1990789/class125), a StatCounter tracking URL, 18 attacker-managed GitHub repositories, 8 GitLab repositories, 3 Codeberg repositories, two ProtonMail sender addresses, commit-log email addresses, and over a hundred SHA256 hashes across the downloader/loader/LNK/JS/RAR stages. Downloaders identify victimized devices by a <volume serial number>@<computer name> string (e.g. 1510781397@DESKTOP-CJU6TU7), which also appears in StatCounter referrer values and GitHub retrieval filenames.

SpyGlace is APT-C-60's custom backdoor. Prior JPCERT/CC analysis (2024-2025) documented that C2 communication uses BASE64 plus a modified RC4 variant (increased KSA cycles with an added XOR value) and that downloaded files are decrypted with AES-128-CBC; the initial C2 request carries MD5 hashes of the userid string 'GOLDBAR' and system identifiers, together with RC4-encrypted device data (ComputerName, UserName, CpuInfo, OS version, SpyGlace version). The malware implements a large command set including download/upload, screenupload/screenauto (screenshots), procspawn, diskinfo, ld, attach/detach, cmd, and the newer 'uld' (loads a module function then unloads it), with prockill/proclist reduced to no-ops in recent versions. Persistence is achieved via COM hijacking (registry InProcServer32 values under HKCU CLSIDs such as {566296fe-e0e8-475f-ba9c-a31ad31620b1}), a technique observed across the 2024, 2025 and 2026 campaigns.

Attribution: JPCERT/CC attributes the campaigns to APT-C-60, a group that has primarily targeted Japan and other East Asian regions (decoy documents suggest Japan, South Korea and China) by impersonating job seekers contacting recruitment/HR staff. Positive Technologies analyzed the same SpyGlace variant (naming it 'GoldBar' after the deobfuscated userid$$$$GOLDBAR string) and concluded that APT-C-60 and APT-Q-12 belong to the DarkHotel cluster; JPCERT/CC confirmed the GOLDBAR userid matches Positive Technologies' DarkHotel reporting. ESET and ThreatBook CTI published independent analyses of SpyGlace, including ESET's disclosure that an earlier 2024 APT-C-60 campaign exploited the WPS Office zero-days CVE-2024-7262/CVE-2024-7263 to deliver the backdoor.

Impact and defense: SpyGlace is a full espionage backdoor capable of file exfiltration, screenshots and remote command execution over encrypted C2, enabling credential and document theft from affected organizations. Because the campaign abuses legitimate services and standard Windows functionality (mshta.exe, git.exe, COM hijacking), JPCERT/CC emphasizes that blocking by communication destination alone is insufficient. Defenders should hunt LNK->mshta.exe->script-download chains, git.exe/gcmd.exe script execution from unusual paths, registry modifications to COM CLSID InProcServer32 values, outbound HTTPS to developer services/CDNs from non-developer hosts, and block the published C2 IPs, repository URLs, sender addresses and file hashes. No CVE or CVSS applies to this campaign; all indicators are grounded in the verified JPCERT/CC report and supporting vendor research.