JPCERT/CC observed targeted phishing emails against Japanese organizations, especially cryptocurrency-related entities, that delivered a ZIP file containing a password-protected decoy document and a malicious shortcut named “Password.txt.lnk.” The shortcut launched mshta to retrieve VBScript from a shortened URL, showed the decoy password to the user, wrote a downloader in the temporary directory, and created a Startup-folder shortcut for persistence when selected security-product process names were absent. The downloader sent POST requests every three minutes and executed returned VBScript, while a later script collected infected-device information every minute and could receive additional encoded payloads. Infrastructure included service.amzonnews.club and update.gdrives.top, with multiple sample hashes and related C2 servers listed in appendices. The limited access counts and cryptocurrency-themed decoys indicate a narrow, customized campaign rather than broad commodity delivery.