JPCERT/CC described recent DangerousPassword activity, also known as CryptoMimic or SnatchCrypto, against cryptocurrency exchange businesses, a campaign it has tracked since 2019. The source says attackers continued shortcut-file delivery but also used LinkedIn messages with RAR-packed CHM files, malicious OneNote files, VHD containers, and macOS-focused payloads to infect targets. The infection chains download MSI or DLL payloads, run PowerShell or curl commands, collect host information, post encoded data to attacker infrastructure, and adjust behavior when antivirus products are detected. The report highlights social-media recruiting lures and cross-platform tradecraft, and lists C2 domains such as azure.protection-service.cloud and docs.azure-protection.cloud plus many malware hashes for defensive tracking.