AhnLab documented six spear-phishing patterns targeting organizations in South Korea during August 2026, with LNK files accounting for the largest share of detected attacks. The chains used PowerShell, AutoIt, scheduled tasks, GitHub-hosted payloads, PubNub communications, DLL side-loading, Python backdoors, and XenoRAT-type malware. Successful execution enabled information theft, remote control, and delivery of additional malware.