diff --git a/objects/spearphishing-campaign/definition.json b/objects/spearphishing-campaign/definition.json
index b480f6f2..b7e15894 100644
--- a/objects/spearphishing-campaign/definition.json
+++ b/objects/spearphishing-campaign/definition.json
@@ -42,6 +42,24 @@
       "multiple": true,
       "ui-priority": 1
     },
+    "mitm-connect-back-ja4": {
+      "description": "JA4 signature used by the TA for log in attempts",
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 1
+    },
+    "mitm-connect-back-ja4http": {
+      "description": "JA4HTTP signature used by the TA for log in attempts",
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 1
+    },
+    "mitm-connect-back-ja4tcp": {
+      "description": "JA4TCP signature used by the TA for log in attempts",
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 1
+    },
     "phishing-domain": {
       "description": "Domain where the phishing stages are hosted",
       "misp-attribute": "domain",
@@ -72,5 +90,5 @@
     "phishing-domain"
   ],
   "uuid": "20241206-9e59-4b7d-9e88-951458f10a5f",
-  "version": 20250919
-}
\ No newline at end of file
+  "version": 20260112
+}