QiAnXin’s RedDrip team reported Lazarus-attributed spear-phishing samples aimed at blockchain, finance, and oil-and-gas targets, including job-opportunity and security-themed lures packaged as ZIP/LNK files or decoy documents. The LNK chain used cmd.exe and mshta.exe to retrieve obfuscated JScript from infrastructure such as googlesheetpage.org, opened Google Drive decoys, checked security processes, wrote JavaScript into the Temp directory, and copied a configured LNK into the Startup folder for persistence. The activity was linked to earlier Lazarus JavaScript code through strong code similarity, and the report lists representative hashes and domains including product.onlinedoc.dev, share.devprocloud.com, and gsheet.gdocsdown.com.