Transparent Tribe Weaponizes “JLPT” Tests in New Cyber-Espionage Campaign Against India

According to CYFIRMA, the Transparent Tribe (APT36), a Pakistan-aligned threat actor known for targeting Indian governmental and strategic entities, has weaponised a JLPT test lure in a new cyber-espionage campaign. The operation, tracked since December 2025, uses a ZIP archive named “Online JLPT Exam Dec 2025[.]zip” that actually deploys a large Windows Shortcut (LNK) file masquerading as a PDF to trigger a malicious chain when opened.

The LNK file leverages mshta.exe to download and run attacker-controlled HTA content in a fileless manner, with the malware decrypting and assembling its payload in memory. It also surveys the host for antivirus products such as Kaspersky, Quick Heal, Avast, and Bitdefender, adjusting its persistence and tactics accordingly. Once settled, the campaign functions as a remote access Trojan, capable of taking screenshots, logging keystrokes, exfiltrating data, and even manipulating the clipboard.

This represents a notable evolution in APT36’s tradecraft, moving from traditional phishing to memory-resident, fileless techniques designed to evade detection, according to the CYFIRMA analysis.