A malicious ZIP contained a PDF-disguised Windows shortcut using a Japanese foreign-policy questionnaire as its lure. The shortcut retrieved VBScript and PowerShell stages from GitLab, established 15-minute scheduled-task persistence, collected system and Downloads-directory information, and uploaded Base64-encoded results to an attacker-controlled GitHub repository. Joe Security attributed the chain to Kimsuky with high confidence because its task name, staging, obfuscation, reconnaissance, cleanup, and exfiltration design closely matched Operation GitPower. The analysis was static and did not confirm successful infection or data transfer.