JPCERT/CC documents continued DangerousPassword, also known as CryptoMimic or SnatchCrypto, activity against cryptocurrency exchanges in Japan. Recent intrusion patterns include LinkedIn job-themed outreach delivering RAR-packed CHM files, OneNote attachments embedding MSI malware, virtual hard disk files containing decoys and DLL loaders, and macOS AppleScript chains. The Windows malware collects infected-host information, downloads additional payloads through MSI, DLL, PowerShell, or curl-based stages, and can alter behavior when antivirus products are detected. The report also lists C2 domains and hashes, showing the campaign has expanded beyond earlier email shortcut-file delivery while retaining financially focused targeting.