A threat group has added Proton Drive to its delivery toolkit, using file-sharing links that appear completely legitimate to walk victims through a chain that ends with a custom backdoor installed on their machine.

 

What happened

A threat group tracked as APT-C-60 has continued a spear-phishing campaign that delivers malware called SpyGlace by abusing Proton Drive, Windows shortcut files, and several trusted developer platforms rather than relying on obviously suspicious infrastructure. According to GBHackers, the campaign begins with an email containing a Proton Drive link. Victims who follow the link are prompted to download a compressed archive containing several files, including a malicious shortcut file disguised to look like a normal document. Once opened, that shortcut quietly launches a legitimate Microsoft tool capable of running small scripts, using it to execute hidden code without the victim seeing anything unusual happen on screen.

 

Going deeper

The hidden code retrieves a file from jsDelivr, a legitimate content delivery network widely used by software developers to distribute files quickly and reliably. That file is decoded and extracted, producing a legitimate copy of a common developer tool called git, which is then used to run an additional script rather than any obviously suspicious program. According to GBHackers, researchers at JPCERT/CC, Japan's national computer emergency response team, identified this campaign as an evolution of previous activity by the same group, and also found related cases where the malicious file arrived directly as an email attachment instead of through the Proton Drive link. The final downloader assembled by the script contacts additional legitimate platforms, including GitHub, to retrieve and run further stages before ultimately installing SpyGlace, the group's signature backdoor tool that gives an attacker ongoing remote access to the infected device.

 

What was said

Researchers noted in findings cited by GBHackers that while the group's core techniques remain consistent with prior activity, including the abuse of legitimate services and the use of the git tool to execute malicious scripts, the newer campaigns expand the group's infrastructure strategy considerably. Where the group previously relied primarily on GitHub and Bitbucket to host and distribute its tools, researchers found the latest activity also uses GitLab, Codeberg, and jsDelivr, platforms that are widely used by developers and frequently permitted under corporate network policies, making it harder for organizations to block malicious traffic simply by blocking known-bad destinations.

 

In the know

Using trusted developer and file-sharing platforms as delivery infrastructure is a technique that has appeared across multiple unrelated threat groups throughout 2025 and 2026, not just this one. According to The Hacker News, an earlier APT-C-60 campaign used Google Drive to host malicious files and abused StatCounter, a legitimate web analytics service, to secretly identify individual victim devices before delivering the next stage of the attack from Bitbucket. The consistent thread across both the earlier and current campaigns is the same underlying advantage attackers are chasing: traffic to widely trusted platforms rarely gets blocked outright, and can look completely ordinary unless a security team is specifically inspecting what files are being downloaded and what happens after.

 

The big picture

Healthcare organizations that allow staff to access common cloud storage and developer platforms as part of normal business operations face a real gap when those same platforms are used to smuggle in malware. Blocking access to services like GitHub, GitLab, or major cloud storage providers outright is rarely practical for an organization, since legitimate business and IT functions often depend on them. That means the burden falls on monitoring what actually happens after a file is downloaded rather than on blocking the platform itself. According to Paubox's 2026 Healthcare Email Security Report, only 5 percent of known phishing attacks are reported by employees to security teams, which means a quiet, multi-stage infection chain built entirely from legitimate-looking tools and trusted destinations is unlikely to be caught through staff reporting and depends almost entirely on technical monitoring to detect.

 

FAQs

Why does using a real file-sharing service like Proton Drive make a phishing email harder to catch?

Email security tools assess the reputation of the links contained in a message. A link pointing to a well-known, legitimate cloud storage provider generally receives a clean reputation score, since that same platform is also used constantly for genuinely harmless purposes. The malicious payload only becomes apparent after the file is downloaded and opened, by which point the initial email itself has already passed inspection.

 

What is a shortcut file, and why is it dangerous when it arrives as part of an email attachment?

A shortcut file, also called an LNK file, is normally just a small pointer that tells a computer where to find and open another file or program. Attackers can configure a shortcut file to secretly launch hidden commands the moment it is opened, using that legitimate Windows feature to execute malicious code without needing to trick the victim into running an obviously suspicious program.

 

Why does using a legitimate developer tool like git to run a script help the attacker avoid detection?

Security tools often build detection around identifying unfamiliar or unauthorized executable programs running on a device. A legitimate, digitally signed tool like git is already present on many systems used by IT and development teams, and using it to execute a malicious script blends the activity in with normal, expected software behavior rather than introducing an obviously new and suspicious program.

 

Why is it difficult for organizations to simply block traffic to platforms like GitHub or content delivery networks?

Many organizations rely on these platforms for legitimate day-to-day operations, including software updates, internal development work, and IT administration tasks. Blocking access outright would disrupt those functions, so organizations generally cannot treat traffic to widely used developer and content delivery platforms as inherently suspicious, which is exactly what attackers are counting on when they choose this kind of infrastructure.

 

What kind of monitoring can catch this type of attack when blocking the destination isn't practical?

Security teams should watch for the specific behavioral pattern this technique relies on, including a legitimate Windows scripting tool being launched directly from a shortcut file, downloads from cloud storage or developer platforms immediately followed by script execution, and unexpected use of development tools like git outside of an organization's normal software development activity.