SpyGlace Attacks Abuse Trusted Developer Services to Evade Network Detection

SpyGlace has returned in a campaign that hides malicious activity behind online services many companies trust.

The operation, linked to APT-C-60, uses spear-phishing emails to steer victims toward a booby-trapped archive and then installs malware through a chain of ordinary tools.

The latest activity shows how attackers can turn normal business traffic into cover. A victim may receive a Proton Drive link leading to a RAR archive, or a malicious attachment directly in the email.

Inside the archive is a Windows shortcut, or LNK file, whose opening begins the infection.

Analysts at JPCERT/CC identified the campaign while tracking continued APT-C-60 activity against organizations in Japan.

They found that the group had changed parts of its entry method and online infrastructure while retaining techniques seen in its 2024 and 2025 operations. The concern is not only the SpyGlace payload, but the way the delivery chain blends in.

It relies on standard Windows programs and familiar development platforms, making basic blocking rules less reliable and leaving organizations to spot suspicious behavior rather than simply suspicious destinations.

JPCERT/CC said in a report shared with Cyber Security News (CSN) that it observed SpyGlace versions 3.1.15, 3.1.17, and 3.1.18, with no major functional differences from earlier samples.

SpyGlace Attacks Abuse Trusted Developer Services

The attack starts when a recipient opens the LNK file. The shortcut copies itself and launches mshta.exe, a legitimate Windows component, to run hidden JavaScript stored inside the file.

That code downloads a file named contributing1.txt, decodes it, and extracts its contents.

Next, the script uses a legitimate copy of git.exe from the extracted files to run another script. The script rebuilds a downloader from several .db fragments, then uses it to collect more downloaders and loaders before launching SpyGlace.

This staged process gives the operators several chances to change material without changing the original lure.

APT-C-60 routed those later downloads through GitHub, GitLab, jsDelivr, and Codeberg. These sites serve developers and content every day, so their traffic can appear harmless in corporate networks.

The group had previously used GitHub and Bitbucket, but the broader 2026 mix expands the number of places defenders must investigate.

Using trusted services does not make the activity legitimate. It makes decisions based only on a website name far less useful.

Security teams need to connect a user action, such as opening an unexpected archive, with follow-on events including mshta.exe execution, unusual git.exe activity, script creation, and downloads from developer platforms.

Phishing Chain Raises Detection Pressure

The campaign demonstrates why phishing defenses remain essential even when an organization tightly manages software.

The initial email is the point where a routine cloud-storage link becomes a compromise path. Users should avoid opening cloud-storage links in suspicious emails and should treat LNK files inside RAR archives as a serious warning sign.

Mail controls should flag unexpected archives and shortcut files, especially when the message asks a recipient to retrieve content from a cloud drive.

Endpoint monitoring should also alert on a shortcut that starts mshta.exe or on git.exe being launched from an unusual temporary or extracted location.

Network teams should review access to code-hosting and content-delivery services in the context of the device and process generating it. An employee browsing a project page is different from an LNK-launched script pulling encoded files.

This behavior-focused approach can preserve normal work while exposing the sequence used to deliver SpyGlace.

The findings also underline the value of keeping a record of observed infrastructure and file hashes.

Blocking or hunting for the indicators below can help identify related activity, but defenders should not rely on them alone because the operators can create new accounts, repositories, files, and delivery links quickly.

JPCERT/CC’s account of the 2026 activity shows an attacker refining familiar methods rather than needing a new exploit.

For organizations, the practical response is to pair user caution with email, endpoint, and network monitoring that can recognize a malicious chain even when each individual service looks trustworthy.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOC Teams.

The post SpyGlace Attacks Abuse Trusted Developer Services to Evade Network Detection appeared first on Cyber Security News.