Loading story…
Microsoft has addressed a long-standing security vulnerability in Windows shortcut (.LNK) files, identified as CVE-2025-9491, which allowed attackers to hide malicious commands within shortcut files using whitespace and other characters. This flaw, actively exploited since at least 2017 by multiple state-sponsored threat actors from China, Iran, North Korea, and Russia, enabled remote code execution by concealing hazardous content from users inspecting file properties in the Windows interface. The vulnerability was finally patched as part of Microsoft's November 2025 Patch Tuesday, following public disclosures and pressure from security researchers and organizations such as Trend Micro and ACROS Security's 0patch.
The issue was initially dismissed by Microsoft as not meeting the threshold for immediate servicing, despite evidence of widespread abuse in espionage and financially motivated campaigns. Security researchers demonstrated that the flaw allowed attackers to disguise malicious .LNK files as harmless documents, bypassing user scrutiny and leveraging the Windows UI's limitations. While Microsoft eventually issued a silent patch to address the visibility of malicious commands, third-party vendors like 0patch released their own fixes, claiming enhanced protection against known attack techniques. The vulnerability's exploitation history and the delayed response highlight ongoing challenges in prioritizing and remediating UI-based security flaws in widely used operating systems.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
After Microsoft's UI-focused change, 0patch released its own micropatch for supported Windows and Windows Server versions. The patch blocks or truncates suspiciously long shortcut targets opened via Explorer and warns users, which 0patch says neutralizes more than 1,000 malicious shortcuts previously identified by Trend Micro.
In November 2025, Microsoft quietly changed Windows so the Properties dialog displays the full shortcut Target command instead of truncating it, mitigating the obfuscation issue behind CVE-2025-9491. Multiple sources say the fix was shipped without a prominent public acknowledgment and followed earlier reluctance to treat the behavior as a vulnerability.
Trend Micro's Zero Day Initiative reported the Windows .LNK command-hiding issue to Microsoft in March 2025 and provided evidence that the flaw was being actively exploited in the wild. The report concerned CVE-2025-9491, which lets attackers conceal malicious commands in shortcut Target fields.
Recent campaigns attributed to Chinese-linked groups including UNC6384, Mustang Panda, and related reporting on XDSpy involved malicious .lnk files targeting Hungarian, Belgian, and other European diplomatic entities. The attacks delivered malware such as PlugX and XDigo while abusing the command-hiding shortcut technique.
Trend Micro discovered the Windows shortcut issue being actively exploited in the wild, including use by Chinese-affiliated actors, and the issue was assigned CVE-2025-9491. The flaw centered on attackers concealing the true command executed by a .lnk file from users inspecting its properties.
Over the following years, at least 11 threat groups linked to China, Iran, North Korea, and Russia used the shortcut-file technique in campaigns against government, diplomatic, financial, telecommunications, and energy targets. Researchers later identified nearly 1,000 malicious shortcut files associated with these operations.
Attackers began exploiting Windows shortcut (.lnk) files to hide malicious commands by padding the Target field with whitespace and long command strings, taking advantage of Windows only showing the first 260 characters in the Properties dialog. Multiple reports say this activity dates back to 2017 and was used by state-sponsored groups for espionage.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcego.theregister.com
Open sourcetechrepublic.com
Open sourcecsoonline.com
Open sourcethehackernews.com
Open sourceblog.0patch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A flaw tracked as **`CVE-2010-2568`** allowed arbitrary code execution on multiple Microsoft Windows versions through crafted **`.LNK`** and **`.PIF`** shortcut files. The vulnerability stemmed from Windows Explorer improperly handling shortcut files while displaying their icons, meaning malicious code could be triggered simply when a user browsed to a location containing the weaponized shortcut. Affected systems included Windows XP SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 SP2 and R2, and Windows 7. The issue was observed in the wild and became closely associated with malware activity targeting industrial environments, including reporting tied to Siemens WinCC SCADA-related exploitation. Microsoft identified the issue in advisory **`2286198`** and addressed it in security update **`MS10-046`**, while US-CERT also highlighted the vulnerability as part of broader Microsoft security updates. The bug could be exploited by local users or remote attackers if a victim accessed removable media or network shares containing the malicious shortcut files.
Aug 15, 2026
Microsoft confirmed that **CVE-2026-32202**, a patched Windows Shell spoofing flaw, has been actively exploited in the wild after initially publishing incorrect exploitability information. The vulnerability is a **zero-click authentication coercion issue** tied to an incomplete fix for **CVE-2026-21510** and can be triggered when Windows Explorer processes a malicious `.LNK` file. Researchers said the shortcut’s crafted `LinkTargetIDList` can force the system to resolve an attacker-controlled UNC path, causing an outbound SMB connection and NTLM authentication attempt before SmartScreen trust checks occur. Akamai and CERT-UA linked the activity to **APT28**, which used weaponized LNK files in campaigns against Ukraine and several EU countries beginning in December 2025, chaining **CVE-2026-21513** with **CVE-2026-21510** for code execution and then abusing the residual flaw to capture **Net-NTLMv2** hashes for relay attacks or offline cracking. Microsoft addressed **CVE-2026-32202** in its April 2026 Patch Tuesday release, and defenders were urged to patch quickly, monitor outbound SMB traffic, and reduce or harden NTLM usage to limit follow-on credential abuse.
Jun 29, 2026
Security researcher **Wietze Beukema** disclosed four techniques for manipulating **Windows `.LNK` shortcut files** so that Windows Explorer’s Properties dialog can show a benign-looking target while the shortcut actually executes a different (potentially malicious) command. The methods abuse inconsistencies in how Windows prioritizes conflicting target paths across optional LNK structures, including use of forbidden path characters (e.g., embedded double quotes), non-conforming `LinkTargetIDList` values that diverge from `LinkInfo`, and a particularly impactful approach that places the “real” execution path in `EnvironmentVariableDataBlock` while presenting a fake target to the user (e.g., showing `invoice.pdf` while executing PowerShell). This enables attackers to better conceal payload execution and command-line arguments from casual inspection, increasing the effectiveness of LNK-based initial access and social engineering. Microsoft stated the newly presented LNK “spoofing issues” are **not considered vulnerabilities** (per the reporting), framing them as behavior arising from the shortcut format and Explorer’s parsing/display logic rather than a security boundary bypass. Separate coverage emphasized the broader takeaway for defenders: **LNK files should be treated as untrusted** due to their complex binary format and the ease with which attackers can craft deceptive shortcuts that appear legitimate in UI surfaces while launching different programs at execution time.
Jun 29, 2026