AhnLab observed spear-phishing campaigns against South Korean entities in September 2026, with malicious LNK files serving as the dominant entry vector. The documented chains used PowerShell, AutoIt, HTA files, scheduled tasks, GitHub-hosted payloads, PubNub communications, information stealers, keyloggers, backdoors, and XenoRAT-type malware. Successful compromise could expose system data, enable remote control, and support further malware deployment.