Hackers Actively Exploit New Windows LNK 0-Day Vulnerability
A newly discovered security vulnerability in Windows shortcut files is being actively exploited by malicious actors targeting diplomatic organizations.
A newly discovered security vulnerability in Windows shortcut files is being actively exploited by malicious actors targeting diplomatic organizations.
The vulnerability enables attackers to embed harmful commands within shortcut files (.lnk), rendering them invisible to users. This flaw was first identified in March 2025 by Trend Micro researchers who noticed that attackers were crafting Windows shortcuts that appeared benign but contained harmful commands. The "Target" field in these shortcuts displayed only the first 260 characters, allowing attackers to use whitespace to conceal malicious code, such as PowerShell scripts.
Initially, Microsoft did not consider this a significant security threat, citing existing warnings for files from the internet. However, in October 2025, Arctic Wolf reported that a group known as UNC6384 was leveraging this vulnerability to target diplomatic entities in Hungary and Belgium by sending malicious shortcuts disguised as PDF documents. Consequently, the issue was assigned CVE-2025-9491.
A newly discovered security vulnerability in Windows shortcut files is being actively exploited by malicious actors targeting diplomatic organizations.
In November 2025, Microsoft made changes to the Windows user interface to display the entire command string in the "Properties" window. However, some critics argue that this does not fully mitigate the risk, as the command may still be difficult to detect in a small display area.
Security firm 0patch has provided an alternative solution by releasing a "micropatch" that blocks suspicious behavior. This patch intervenes if a shortcut's "Target" exceeds 260 characters, effectively neutralizing the hidden malicious code and alerting the user. The fix is available for multiple Windows versions, including Windows 10, Windows 11, and several Windows Server editions, some of which did not receive an official Microsoft fix.
Exercise caution when opening shortcut files (.lnk), especially those received via email or appearing as documents. Ensure Windows systems are fully updated. Consider using third-party patches like those from 0patch for additional protection, particularly on older systems.
Based on reporting by GBHackers.