APT-C-60 Hackers Abuse Proton Drive and Developer Platforms to Deploy SpyGlace Malware

Threat group APT-C-60 has updated its cyberespionage delivery chain by using Proton Drive, malicious Windows shortcut files, and trusted developer platforms to deploy the SpyGlace malware. The activity, observed by JPCERT/CC in 2026, continues the group’s targeting of organizations in Japan while making malicious traffic appear more legitimate.blogs.jpcert+1 The campaign begins with spear-phishing emails containing a Proton Drive link that leads to a RAR archive. In another…

Diamond Model