Loading story…
A sophisticated phishing campaign has been identified in which attackers distribute ZIP archives containing malicious Windows shortcut files (.lnk) disguised as legitimate documents such as payment records, certified documents, and passport scans. Cybersecurity researchers at Blackpoint Cyber discovered that these phishing emails are often tailored to target senior employees or managers, leveraging themes that mimic routine executive workflows like identity verification and payment approvals. When a recipient opens the ZIP file and clicks on a shortcut, a hidden PowerShell script is executed in the background without the user's knowledge. This script is designed to download a payload from a remote server, with the file masquerading as a PowerPoint presentation but actually being a malicious DLL. The attackers employ a technique known as 'living off the land,' using the legitimate Windows binary rundll32.exe to execute the downloaded DLL, thereby blending their activity with normal system operations and evading detection. The PowerShell dropper is further obfuscated and uses multiple 'quiet flags' to suppress any visible prompts or permission requests, making the attack stealthy and difficult for users to notice. The malicious activity is further camouflaged by leveraging signed Windows binaries, which are typically trusted by security controls. Blackpoint Cyber's Security Operations Center observed that the attackers deliberately mislabel the DLL to avoid suspicion. The campaign's success relies heavily on social engineering, exploiting the trust users place in document-themed content and the routine handling of ZIP archives in business environments. Security experts have recommended that organizations prohibit the use of LNK files within archives, enforce the Mark of the Web on downloaded files, and restrict the use of rundll32.exe to mitigate such threats. Additionally, enabling script block logging and transcription can help detect and investigate suspicious PowerShell activity. The campaign highlights the ongoing evolution of phishing tactics, with attackers increasingly using built-in system tools and trusted file formats to bypass traditional security measures. The use of identity-themed lures and executive targeting suggests a focus on high-value victims, potentially leading to significant organizational compromise if successful. The incident underscores the importance of user awareness training, robust email filtering, and endpoint monitoring to detect and prevent similar attacks. Organizations are urged to review their security policies regarding the handling of ZIP files and shortcut files, as well as to implement technical controls that can block or alert on suspicious script execution. The attack demonstrates how a single click on a seemingly innocuous file can result in the silent installation of malware, emphasizing the need for layered defenses. Security teams should remain vigilant for new variations of this technique, as attackers may adapt their methods to evade updated protections. The campaign serves as a reminder that even familiar file types and workflows can be weaponized by threat actors to gain initial access to corporate networks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Security reporting described a malware distribution technique in which malicious ZIP archives contain weaponized Windows shortcut (.LNK) files that trigger malware delivery when opened. The references do not provide a more specific discovery date, so the event is dated from the publication date of the reports.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers distributed malicious Windows shortcut (`.LNK`) files disguised as privacy consent forms and other work-related documents, tricking users into launching obfuscated PowerShell that fetched additional payloads from external infrastructure. Reporting indicates GitHub was used as a covert stage in the infection chain, helping operators blend malicious downloads and command retrieval into legitimate web traffic while keeping much of the activity fileless and in memory. Once executed, the malware created downloader and loader scripts, established persistence through Windows Task Scheduler, opened decoy documents to reduce suspicion, and deleted the original shortcut to limit forensic artifacts. Observed follow-on payloads included an information stealer and a backdoor loader that decrypted and loaded malware into memory; the theft activity gathered host, security product, network, IP, drive, file, and process data, with behavior resembling prior **Kimsuky**-linked operations.
Jun 29, 2026
Threat actors are increasingly abusing Windows shortcut files (`.LNK`) as a low-friction mechanism for initial access, payload execution, and persistence across phishing and archive-based intrusion chains. Multiple reports describe attackers disguising LNKs as PDFs, resumes, project files, or document shortcuts inside ZIP, RAR, ISO, and IMG containers, then using them to launch LOLBins and scripts such as `powershell.exe`, `mshta.exe`, `regsvr32.exe`, `rundll32.exe`, `cmd.exe`, and `MSBuild.exe`. Campaigns tied to QakBot, Emotet, Bumblebee, MORE_EGGS, Gamaredon, APT37, Higaisa, and likely APT41/Winnti used LNK-triggered chains to download payloads, execute JavaScript or PowerShell, establish scheduled-task or Startup-folder persistence, and deploy stealers, RATs, and backdoors. Researchers note the trend accelerated after Microsoft blocked internet-downloaded Office macros by default, pushing operators toward shortcut-based delivery. Defenders are being urged to inspect the LNK `Target` field and underlying Shell Link structures for suspicious command lines, embedded URLs or IPs, oversized files, and metadata anomalies such as mismatched `TrackerDataBlock` MAC information. Microsoft’s Shell Link specification provides the file-format baseline, while incident-response guidance highlights that `explorer.exe` often appears as the parent process, making file telemetry and LNK creation events critical for hunting. Analysts also point to builder ecosystems such as **mLNK Builder** that lower the barrier for criminal use and improve evasion, alongside older LNK-related exploitation history including `CVE-2010-2568`, which allowed code execution when Windows rendered crafted shortcut icons. Together, the reporting shows `.LNK` files have become a durable and versatile attack primitive spanning commodity malware, espionage operations, and persistence tradecraft.
Aug 15, 2026
Threat actors increasingly replaced macro-enabled Office documents with **Windows shortcut (`.LNK`) files**, **ISO images**, and **HTML smuggling** to gain initial access on Windows systems after Microsoft tightened macro protections and as adversaries sought ways around Mark-of-the-Web controls, including **`CVE-2022-41049`**. Fortinet reported phishing campaigns in 2022 delivering **Emotet, Qbot/QakBot, IcedID, and Bumblebee** through Excel 4.0 macros early on, then shifting to LNK files, ISO containers, and browser-reconstructed payloads that launched malware via native tools such as ```cmd powershell mshta.exe regsvr32.exe rundll32.exe curl cmd.exe ``` A separate Fortinet investigation detailed a QakBot campaign in which an attached HTML file dropped a ZIP archive containing a malicious LNK that fetched a loader DLL and executed the core malware filelessly inside a hollowed process. Cisco Talos found that the growing use of malicious LNK files also created a forensic trail: embedded metadata such as **Drive Serial Number, MachineID, DROID GUIDs, timestamps, paths, and SIDs** can link campaigns and expose the systems used to build the shortcuts. Talos used Qakbot and Gamaredon examples to show how LNK metadata supports clustering and hunting, and identified metadata-based ties between **Bumblebee**, **IcedID**, and **Qakbot**, suggesting shared tooling or operational overlap. Earlier Fortinet reporting showed LNK-based phishing was already being used in espionage operations, including a campaign targeting Ukrainian government entities with ZIP archives containing malicious shortcuts, reinforcing that LNK files had become a versatile delivery mechanism for both financially motivated malware and state-linked intrusion activity.
Aug 15, 2026