A reported campaign tied to APT-C-60 shows how a legitimate file-sharing service, a Windows shortcut, and a normal developer tool can be chained into a deceptive delivery path.
A reported SpyGlace delivery path shows how public cloud storage, Windows shortcuts, and trusted developer tooling can be blended into one deceptively ordinary-looking intrusion chain.