JSAC2026 Sessions Cover Malware Analysis, Phishing Threats and Security Operations
Summary
JPCERT/CC recaps JSAC2026 sessions on malware reverse engineering, phishing campaigns, spoofing risks in shared hosting, phishing-site investigations, and fraud prevention, alongside a discussion of 2025 security incidents.
Key points
- Workshops gave participants hands-on practice triaging malicious emails and reverse engineering Guloader, Gremlin, and .NET Native AOT malware.
- A presentation described HoldingHandsRAT phishing targeting Japanese organizations, including password-protected executables and suspected stolen digital signatures.
- Speakers warned that shared email infrastructure can let malicious hosting tenants exploit providers’ SPF-authorized IP addresses to impersonate them.
- TOAMI, IKESU, and CHOKA were presented as tools to streamline phishing-site investigation, log review, and abuse reporting.
- A campaign abused fork-derived GitHub commits and malvertising to distribute HijackLoader on Windows and AMOS Stealer on macOS.
- Research on phone numbers used in investment and romance scams found lines were often contracted shortly before and terminated soon after the fraud, raising concerns about SMS verification alone.
- Some panel and threat-research details were withheld because they were designated TLP:RED.
Article Details
- Event Type
- JSAC2026 conference sessions presenting security research, incident-analysis methods, and defensive tools.
- Impact
- The sessions discussed phishing and malware targeting Japanese organizations and developers, risks from shared email infrastructure and fraudulent mobile-number use, and methods to improve malware analysis and phishing-site response. No new incident or quantified impact was reported.
People
Akihiro JinWorkshop speaker on reverse engineering .NET Native AOT malware.Akihiro KidaWorkshop speaker on reverse engineering .NET Native AOT malware.Akihiro YoshitakeWorkshop speaker on reverse engineering .NET Native AOT malware.Albert SongNamed speaker for the Special Recognition Award presentation on the CoGUI Phishing Kit.Hiroaki HaraJSAC2026 CFP Review Board member who participated in the panel discussion of 2025 security incidents.Lime ChenNamed speaker for the Special Recognition Award presentation on the CoGUI Phishing Kit.Manabu NisekiWorkshop speaker who presented email analysis and triage using EML Analyzer.Mark LimPalo Alto Networks, Inc. speaker who led a malware reverse-engineering workshop.Michał PraszmoCERT Polska workshop speaker who presented email analysis and triage using EML Analyzer.Minoru KobayashiJSAC2026 CFP Review Board member who participated in the panel discussion of 2025 security incidents.Rintaro KoikeJSAC2026 CFP Review Board member who participated in the panel discussion of 2025 security incidents.Ruth NgPricewaterhouseCoopers Hong Kong speaker on Initial Access Brokers and state-sponsored cyber attacks.Ryosuke TogashiNTT DOCOMO BUSINESS, Inc. speaker on risks in shared hosting and email infrastructure.Shadow LiuNamed speaker for the Special Recognition Award presentation on the CoGUI Phishing Kit.Shota NakajimaJSAC2026 CFP Review Board member who participated in the panel discussion of 2025 security incidents.Shusei TomonagaJPCERT/CC representative and JSAC2026 CFP Review Board member who participated in the panel discussion of 2025 security incidents.Steve SuJSAC2026 CFP Review Board member who participated in the panel discussion of 2025 security incidents.Takayuki TomatsuriNTT Security Japan Co., Ltd. speaker on risks in shared hosting and email infrastructure.Theo WebbGMO Cybersecurity by Ierae, Inc. speaker who analyzed malware distribution through abused GitHub repositories.Toshiki TakeuchiNEC speaker who analyzed HoldingHandsRAT attacks targeting Japanese companies.Yu NakatsuruJSAC2026 CFP Review Board member who participated in the panel discussion of 2025 security incidents.Yuichi TsuboiNTT DOCOMO BUSINESS, Inc. speaker who introduced TOAMI, IKESU, and CHOKA for phishing investigations.Yuki YanoArticle author who reported on JSAC2026 sessions.yumanoSpeaker who presented research on mobile numbers used in overseas investment scams and similar fraud schemes.Yusuke NiwaJSAC2026 CFP Review Board member who participated in the panel discussion of 2025 security incidents.
Malware
AMOS StealerOn Windows systems, this resulted in the execution of malware including HijackLoader, while on macOS systems, it led to infection with AMOS Stealer.Gremlin - Gremlin: an infostealerGuloader - Guloader: a multi-stage dropperHIJACKLOADEROn Windows systems, this resulted in the execution of malware including HijackLoader, while on macOS systems, it led to infection with AMOS Stealer.HoldingHandsRATHoldingHandsRAT Attacks Against Japanese Companies
Products
GitHubDeceiving Developers: Abusing Legitimate GitHub Repositories to Deliver MalwaremacOSOn Windows systems, this resulted in the execution of malware including HijackLoader, while on macOS systems, it led to infection with AMOS Stealer.Microsoft Outlook - Identifying the source host IP that relayed the email to a Microsoft Outlook environmentMicrosoft WindowsOn Windows systems, this resulted in the execution of malware including HijackLoader, while on macOS systems, it led to infection with AMOS Stealer.Roundcube - Identifying the attacker-controlled C2 server used in a Roundcube XSS attack
Tools
CHOKAEfficient Phishing Site Hunting with TOAMI, IKESU, and CHOKA: Browser Extension Integration for Streamlined OperationsdnSpyTraditional .NET malware typically retains IL code and extensive metadata, making analysis with decompiles such as dnSpy relatively straightforward.EML AnalyzerLeveraging EML Analyzer to Triage Malicious Email Messages During Incident ResponseGhidraThrough hands-on exercises using Ghidra and IDA Pro, participants learned how to identify functions derived from standard libraries and narrow down relevant code for analysis.IDA ProThrough hands-on exercises using Ghidra and IDA Pro, participants learned how to identify functions derived from standard libraries and narrow down relevant code for analysis.IKESUEfficient Phishing Site Hunting with TOAMI, IKESU, and CHOKA: Browser Extension Integration for Streamlined OperationsTOAMIEfficient Phishing Site Hunting with TOAMI, IKESU, and CHOKA: Browser Extension Integration for Streamlined Operations