What are the signs that a phishing campaign is using an ISO or LNK delivery chain?

A common sign is an email that looks like a document handoff but delivers a password protected archive containing an ISO file. Inside, the attacker may hide a LNK file disguised as a document and a DLL that is launched through regsvr32. That chain is designed to evade warning prompts and shift execution into multiple stages.

What the delivery chain is trying to hide

An ISO or LNK delivery chain is effective because it looks like a routine file handoff while quietly splitting execution across several stages. The campaign usually starts with a password-protected archive, then uses an ISO container to avoid the obvious signs people associate with a simple attachment. The key signal is not just the file type, but the intent to make the payload look inert until it is mounted or opened.

Watch for the mismatch between the message and the artifact. A sender may frame the email as a shared invoice, report, or secure document, but the attachment is an archive that leads to disk-image content rather than a normal document. When the chain is built well, each step tries to appear legitimate on its own, which is why the overall delivery pattern matters more than any single filename.

A useful comparison point is the way attackers stage access through indirect delivery rather than a direct executable. That behavior often maps to broader adversary tradecraft described in MITRE ATT&CK Enterprise Matrix, especially where the chain is designed to delay detection and hide the real launch point.

Observable signs in the email and attachment chain

The most obvious sign is a document-themed email that pushes the recipient toward a non-document container. Instead of a PDF or Office file, the attachment path leads to an archive, an ISO, then a shortcut file, and finally a script or DLL. That sequence is suspicious because it relies on the recipient following prompts that feel like normal file handling rather than running malware directly.

Password-protected archive with a vague or generic filename.
ISO image used as the next stage rather than a standard document attachment.
LNK file presented as if it were the expected file the user wanted to open.
DLL or script dropped alongside the shortcut and launched indirectly.
Use of a legitimate Windows utility such as regsvr32 to trigger execution without a typical installer prompt.

The practical clue is the chain depth. If the user must open, mount, click, and then trust a second-stage file before anything visible happens, you are likely looking at a delivery path built to bypass casual inspection. The abuse pattern aligns with defensive guidance in MITRE ATT&CK Enterprise around execution and defense evasion.

Risk and Threat Considerations

ISO and LNK delivery chains are risky because they reduce the chance that a gateway, user, or endpoint will see a single obvious malicious executable. Each stage can look harmless in isolation, which gives the campaign room to evade filtering and delay suspicion until a second-stage payload runs.

Failure mechanism: The attacker hides execution inside nested file handling, then uses shortcut and system-utility behavior to launch the next payload while avoiding the warning signals that usually come with direct executable delivery.

Impact: If the chain succeeds, the endpoint can be turned into a staging point for credential theft, follow-on malware, or broader compromise before the user understands that any execution has occurred.

The identity and access angle matters because these campaigns often aim to reach tokens, credentials, or session material after initial execution. That makes the delivery chain a gateway problem, not just a file-format problem, and it is one reason organizations pair phishing detection with stronger identity controls such as phishing-resistant authentication in NIST SP 800-63 Digital Identity Guidelines.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK address the attack and risk surface, while NIST SP 800-63 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1204 — User Execution	Phishing-delivered ISO/LNK chains rely on the user to open staged content.
	T1059 — Command and Scripting Interpreter	DLL or script launch through native utilities reflects scripted execution tradecraft.
	T1218 — System Binary Proxy Execution	regsvr32 is commonly abused to execute payloads through trusted Windows binaries.
Recommendation — Map staged attachment delivery to T1204 and hunt for user-triggered execution paths. Correlate suspicious regsvr32 or script-launch activity with T1059 execution telemetry. Monitor trusted binary abuse under T1218 when regsvr32 launches an unexpected DLL.
NIST SP 800-63	3.1 — Digital Identity Acceptance Guidelines	Phishing campaigns often aim to steal credentials or tokens after initial execution.
	5.1.7 — Phishing Resistance	The campaign is a phishing delivery path designed to defeat user trust and prompt handling.
Recommendation — Use phishing-resistant authenticators and acceptance checks to reduce credential capture from staged payloads. Require phishing-resistant authentication for accounts exposed to staged phishing delivery chains.
CIS Controls v8	8 — Audit Log Management	Detection depends on observing abnormal mount, shortcut, and regsvr32 activity.
Recommendation — Centralize endpoint and process telemetry to detect ISO mounting and shortcut-based execution chains.

Practitioner Guidance

What to prioritize: Treat the archive-to-ISO-to-LNK sequence as a high-confidence indicator when the email framing is ordinary business correspondence. The more the attachment path depends on user curiosity rather than expected document behavior, the more aggressively it should be isolated and inspected.

What to verify: Confirm whether the ISO contains a shortcut that masquerades as a document and whether any DLL is launched through a benign-looking system binary. If the execution path depends on mounting, double-clicking, or enabling content outside normal document workflows, the message should be handled as a staged intrusion attempt rather than a simple phishing email.

Practitioner takeaway: The decisive signal is not the ISO or the LNK alone, but the full staged handoff from email to archive to image to shortcut to execution. Defenders should tune for that sequence, because the chain is built to look mundane at each step while the real risk emerges only when the stages are combined.