Loading story…
Security researcher Wietze Beukema disclosed four techniques for manipulating Windows .LNK shortcut files so that Windows Explorer’s Properties dialog can show a benign-looking target while the shortcut actually executes a different (potentially malicious) command. The methods abuse inconsistencies in how Windows prioritizes conflicting target paths across optional LNK structures, including use of forbidden path characters (e.g., embedded double quotes), non-conforming LinkTargetIDList values that diverge from LinkInfo, and a particularly impactful approach that places the “real” execution path in EnvironmentVariableDataBlock while presenting a fake target to the user (e.g., showing invoice.pdf while executing PowerShell). This enables attackers to better conceal payload execution and command-line arguments from casual inspection, increasing the effectiveness of LNK-based initial access and social engineering.
Microsoft stated the newly presented LNK “spoofing issues” are not considered vulnerabilities (per the reporting), framing them as behavior arising from the shortcut format and Explorer’s parsing/display logic rather than a security boundary bypass. Separate coverage emphasized the broader takeaway for defenders: LNK files should be treated as untrusted due to their complex binary format and the ease with which attackers can craft deceptive shortcuts that appear legitimate in UI surfaces while launching different programs at execution time.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft Security Response Center said it would not classify the EnvironmentVariableDataBlock shortcut spoofing issue, tracked as VULN-162145, as a vulnerability. Microsoft cited required user interaction, no security boundary bypass, and existing protections such as Defender, Smart App Control, and warnings for Internet-downloaded .lnk files.
Alongside the disclosure, Beukema released the open-source 'lnk-it-up' toolkit to generate test LNK files using the newly described spoofing methods and to help detect suspicious shortcuts by comparing displayed versus executed targets.
At Wild West Hackin' Fest, researcher Wietze Beukema disclosed four techniques for crafting .LNK files that display a benign target in Windows Explorer while executing a different malicious target. The methods abuse inconsistencies in how Windows resolves conflicting shortcut target data structures.
Microsoft appears to have introduced silent changes to Windows .LNK handling in June 2025 to mitigate CVE-2025-9491, a shortcut argument-hiding issue. The flaw had reportedly been exploited by numerous state-sponsored and criminal groups.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly abusing Windows shortcut files (`.LNK`) as a low-friction mechanism for initial access, payload execution, and persistence across phishing and archive-based intrusion chains. Multiple reports describe attackers disguising LNKs as PDFs, resumes, project files, or document shortcuts inside ZIP, RAR, ISO, and IMG containers, then using them to launch LOLBins and scripts such as `powershell.exe`, `mshta.exe`, `regsvr32.exe`, `rundll32.exe`, `cmd.exe`, and `MSBuild.exe`. Campaigns tied to QakBot, Emotet, Bumblebee, MORE_EGGS, Gamaredon, APT37, Higaisa, and likely APT41/Winnti used LNK-triggered chains to download payloads, execute JavaScript or PowerShell, establish scheduled-task or Startup-folder persistence, and deploy stealers, RATs, and backdoors. Researchers note the trend accelerated after Microsoft blocked internet-downloaded Office macros by default, pushing operators toward shortcut-based delivery. Defenders are being urged to inspect the LNK `Target` field and underlying Shell Link structures for suspicious command lines, embedded URLs or IPs, oversized files, and metadata anomalies such as mismatched `TrackerDataBlock` MAC information. Microsoft’s Shell Link specification provides the file-format baseline, while incident-response guidance highlights that `explorer.exe` often appears as the parent process, making file telemetry and LNK creation events critical for hunting. Analysts also point to builder ecosystems such as **mLNK Builder** that lower the barrier for criminal use and improve evasion, alongside older LNK-related exploitation history including `CVE-2010-2568`, which allowed code execution when Windows rendered crafted shortcut icons. Together, the reporting shows `.LNK` files have become a durable and versatile attack primitive spanning commodity malware, espionage operations, and persistence tradecraft.
Aug 15, 2026
Microsoft has addressed a long-standing security vulnerability in Windows shortcut (.LNK) files, identified as CVE-2025-9491, which allowed attackers to hide malicious commands within shortcut files using whitespace and other characters. This flaw, actively exploited since at least 2017 by multiple state-sponsored threat actors from China, Iran, North Korea, and Russia, enabled remote code execution by concealing hazardous content from users inspecting file properties in the Windows interface. The vulnerability was finally patched as part of Microsoft's November 2025 Patch Tuesday, following public disclosures and pressure from security researchers and organizations such as Trend Micro and ACROS Security's 0patch. The issue was initially dismissed by Microsoft as not meeting the threshold for immediate servicing, despite evidence of widespread abuse in espionage and financially motivated campaigns. Security researchers demonstrated that the flaw allowed attackers to disguise malicious .LNK files as harmless documents, bypassing user scrutiny and leveraging the Windows UI's limitations. While Microsoft eventually issued a silent patch to address the visibility of malicious commands, third-party vendors like 0patch released their own fixes, claiming enhanced protection against known attack techniques. The vulnerability's exploitation history and the delayed response highlight ongoing challenges in prioritizing and remediating UI-based security flaws in widely used operating systems.
Jul 23, 2026
A flaw tracked as **`CVE-2010-2568`** allowed arbitrary code execution on multiple Microsoft Windows versions through crafted **`.LNK`** and **`.PIF`** shortcut files. The vulnerability stemmed from Windows Explorer improperly handling shortcut files while displaying their icons, meaning malicious code could be triggered simply when a user browsed to a location containing the weaponized shortcut. Affected systems included Windows XP SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 SP2 and R2, and Windows 7. The issue was observed in the wild and became closely associated with malware activity targeting industrial environments, including reporting tied to Siemens WinCC SCADA-related exploitation. Microsoft identified the issue in advisory **`2286198`** and addressed it in security update **`MS10-046`**, while US-CERT also highlighted the vulnerability as part of broader Microsoft security updates. The bug could be exploited by local users or remote attackers if a victim accessed removable media or network shares containing the malicious shortcut files.
Aug 15, 2026