Loading story…
Threat actors are increasingly using malicious Windows shortcut (.lnk) files to execute payloads through trusted Windows components such as Explorer and other living-off-the-land binaries (LOLBins), shifting away from macro-based initial access techniques that have become less reliable due to Microsoft hardening. The activity highlighted by SentinelOne shows attackers embedding commands and execution chains inside shortcut files so that user interaction with what appears to be a benign file can trigger malware delivery while blending into normal operating system behavior.
The technique allows adversaries to evade defenses that focus on Office macros and to reduce the need for custom droppers by abusing native binaries already present on Windows systems. For defenders, the reporting underscores the need to inspect .lnk files, monitor suspicious child processes spawned by explorer.exe, and hunt for unusual LOLBin execution patterns tied to shortcut launches, as these methods can support phishing, malware staging, and broader post-compromise activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
SentinelOne published research describing threat actors shifting from macro-based delivery to abusing Windows shortcuts and LOLBins such as Explorer for malicious execution. The reference does not provide a specific earlier event date, so the publication date is used as the timeline marker.
Proofpoint reported that from October 2021 through June 2022, email-borne malware campaigns using macro-enabled attachments fell by about 66% while use of container files such as ISO and RAR and Windows Shortcut (LNK) files rose sharply. The company highlighted a 1,675% increase in campaigns containing LNK files and more than 150% growth in ISO use as threat actors adapted to macro blocking in Office.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
sentinelone.com
Open sourcedocs.microsoft.com
Open sourcedocs.microsoft.com
Open sourcedocs.microsoft.com
Open sourceattack.mitre.org
Open sourcecert.gov.ua
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly abusing Windows shortcut files (`.LNK`) as a low-friction mechanism for initial access, payload execution, and persistence across phishing and archive-based intrusion chains. Multiple reports describe attackers disguising LNKs as PDFs, resumes, project files, or document shortcuts inside ZIP, RAR, ISO, and IMG containers, then using them to launch LOLBins and scripts such as `powershell.exe`, `mshta.exe`, `regsvr32.exe`, `rundll32.exe`, `cmd.exe`, and `MSBuild.exe`. Campaigns tied to QakBot, Emotet, Bumblebee, MORE_EGGS, Gamaredon, APT37, Higaisa, and likely APT41/Winnti used LNK-triggered chains to download payloads, execute JavaScript or PowerShell, establish scheduled-task or Startup-folder persistence, and deploy stealers, RATs, and backdoors. Researchers note the trend accelerated after Microsoft blocked internet-downloaded Office macros by default, pushing operators toward shortcut-based delivery. Defenders are being urged to inspect the LNK `Target` field and underlying Shell Link structures for suspicious command lines, embedded URLs or IPs, oversized files, and metadata anomalies such as mismatched `TrackerDataBlock` MAC information. Microsoft’s Shell Link specification provides the file-format baseline, while incident-response guidance highlights that `explorer.exe` often appears as the parent process, making file telemetry and LNK creation events critical for hunting. Analysts also point to builder ecosystems such as **mLNK Builder** that lower the barrier for criminal use and improve evasion, alongside older LNK-related exploitation history including `CVE-2010-2568`, which allowed code execution when Windows rendered crafted shortcut icons. Together, the reporting shows `.LNK` files have become a durable and versatile attack primitive spanning commodity malware, espionage operations, and persistence tradecraft.
Aug 15, 2026
Threat actors increasingly replaced macro-enabled Office documents with **Windows shortcut (`.LNK`) files**, **ISO images**, and **HTML smuggling** to gain initial access on Windows systems after Microsoft tightened macro protections and as adversaries sought ways around Mark-of-the-Web controls, including **`CVE-2022-41049`**. Fortinet reported phishing campaigns in 2022 delivering **Emotet, Qbot/QakBot, IcedID, and Bumblebee** through Excel 4.0 macros early on, then shifting to LNK files, ISO containers, and browser-reconstructed payloads that launched malware via native tools such as ```cmd powershell mshta.exe regsvr32.exe rundll32.exe curl cmd.exe ``` A separate Fortinet investigation detailed a QakBot campaign in which an attached HTML file dropped a ZIP archive containing a malicious LNK that fetched a loader DLL and executed the core malware filelessly inside a hollowed process. Cisco Talos found that the growing use of malicious LNK files also created a forensic trail: embedded metadata such as **Drive Serial Number, MachineID, DROID GUIDs, timestamps, paths, and SIDs** can link campaigns and expose the systems used to build the shortcuts. Talos used Qakbot and Gamaredon examples to show how LNK metadata supports clustering and hunting, and identified metadata-based ties between **Bumblebee**, **IcedID**, and **Qakbot**, suggesting shared tooling or operational overlap. Earlier Fortinet reporting showed LNK-based phishing was already being used in espionage operations, including a campaign targeting Ukrainian government entities with ZIP archives containing malicious shortcuts, reinforcing that LNK files had become a versatile delivery mechanism for both financially motivated malware and state-linked intrusion activity.
Aug 15, 2026
A sophisticated phishing campaign has been identified in which attackers distribute ZIP archives containing malicious Windows shortcut files (.lnk) disguised as legitimate documents such as payment records, certified documents, and passport scans. Cybersecurity researchers at Blackpoint Cyber discovered that these phishing emails are often tailored to target senior employees or managers, leveraging themes that mimic routine executive workflows like identity verification and payment approvals. When a recipient opens the ZIP file and clicks on a shortcut, a hidden PowerShell script is executed in the background without the user's knowledge. This script is designed to download a payload from a remote server, with the file masquerading as a PowerPoint presentation but actually being a malicious DLL. The attackers employ a technique known as 'living off the land,' using the legitimate Windows binary rundll32.exe to execute the downloaded DLL, thereby blending their activity with normal system operations and evading detection. The PowerShell dropper is further obfuscated and uses multiple 'quiet flags' to suppress any visible prompts or permission requests, making the attack stealthy and difficult for users to notice. The malicious activity is further camouflaged by leveraging signed Windows binaries, which are typically trusted by security controls. Blackpoint Cyber's Security Operations Center observed that the attackers deliberately mislabel the DLL to avoid suspicion. The campaign's success relies heavily on social engineering, exploiting the trust users place in document-themed content and the routine handling of ZIP archives in business environments. Security experts have recommended that organizations prohibit the use of LNK files within archives, enforce the Mark of the Web on downloaded files, and restrict the use of rundll32.exe to mitigate such threats. Additionally, enabling script block logging and transcription can help detect and investigate suspicious PowerShell activity. The campaign highlights the ongoing evolution of phishing tactics, with attackers increasingly using built-in system tools and trusted file formats to bypass traditional security measures. The use of identity-themed lures and executive targeting suggests a focus on high-value victims, potentially leading to significant organizational compromise if successful. The incident underscores the importance of user awareness training, robust email filtering, and endpoint monitoring to detect and prevent similar attacks. Organizations are urged to review their security policies regarding the handling of ZIP files and shortcut files, as well as to implement technical controls that can block or alert on suspicious script execution. The attack demonstrates how a single click on a seemingly innocuous file can result in the silent installation of malware, emphasizing the need for layered defenses. Security teams should remain vigilant for new variations of this technique, as attackers may adapt their methods to evade updated protections. The campaign serves as a reminder that even familiar file types and workflows can be weaponized by threat actors to gain initial access to corporate networks.
Jun 29, 2026