APT-C-60 Hackers Abuse Proton Drive and Developer Platforms to Deploy SpyGlace Malware

Threat group APT-C-60 has updated its cyberespionage delivery chain by using Proton Drive, malicious Windows shortcut files, and trusted developer platforms to deploy the SpyGlace malware.

The activity, observed by JPCERT/CC in 2026, continues the group’s targeting of organizations in Japan while making malicious traffic appear more legitimate.blogs.jpcert+1

The campaign begins with spear-phishing emails containing a Proton Drive link that leads to a RAR archive.

In another observed case, the archive was directly attached to the email. The archive contains a malicious Windows shortcut, or LNK, file that launches the infection after a victim opens it.

APT-C-60 Deploys SpyGlace Malware

The malicious LNK file copies itself and invokes the legitimate Windows utility mshta.exe to run embedded JavaScript.

This living-off-the-land approach helps attackers blend malicious activity with normal Windows processes. It can reduce the effectiveness of simple application-based blocking.

The obfuscated JavaScript downloads a file named contributing[1].txt from the jsDelivr content delivery network.

It then searches, decodes, and extracts the downloaded content, and then uses a legitimate git.exe binary from the extracted files to execute the next-stage script.

APT-C-60 expanded its abuse of legitimate development services in 2026. The group used GitHub, GitLab, Codeberg, and jsDelivr as infrastructure to host or distribute attack components.

Developers commonly use these platforms and are often permitted to access them through corporate firewalls and proxy policies. This creates a detection challenge: a connection to GitHub or a public CDN is not automatically suspicious.

Security teams must instead examine repository reputation, URL paths, unusual download patterns, endpoint process chains, and the behavior of files retrieved from these services.

The campaign also used Proton Drive as an initial delivery channel. Cloud-storage links can bypass some email gateway controls because the malicious archive is hosted externally rather than attached directly to a message.

Employees should treat unexpected cloud-storage links, password-protected archives, and LNK files as high-risk content, JPCERT said.

Organizations should hunt for suspicious mshta.exe execution originating from LNK files, unexpected git.exe use from temporary or user-writable directories, and downloads from developer platforms immediately followed by script execution.

They should also block or alert on the identified SpyGlace command-and-control infrastructure, including 31.58.136[.]207, 154.18.239[.]209, and 173.234.11[.]141.

APT-C-60’s latest activity shows how threat actors can combine phishing, native Windows tools, cloud storage, CDNs, and developer services into a stealthy malware delivery chain.

Defenders should prioritize behavior-based detection rather than relying only on domain blocking, especially where trusted web services are essential to business operations.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.

The post APT-C-60 Hackers Abuse Proton Drive and Developer Platforms to Deploy SpyGlace Malware appeared first on Cyber Security News.