Malicious LNK Files Guide: Shortcut-Based Malware Delivery and Defences

A malicious LNK file is a Windows shortcut file crafted so that double-clicking it runs a command or program chosen by an attacker, instead of simply opening the document or folder it appears to be. In plain terms, a shortcut is a small pointer file, and Windows will happily follow a pointer to a command interpreter with arguments attached, while showing the user a friendly icon such as a PDF or a folder. Since Microsoft began blocking macros in Office files from the internet in 2022, shortcut files have become one of the main ways commodity malware loaders and espionage groups get their first code to run. This guide explains how shortcut files work, how they are delivered in archives and disk images, how Mark-of-the-Web (MotW) and SmartScreen interact with them, and which controls stop them. It is written for email, endpoint and SOC teams, and contains no samples or attacker procedures.

Key takeaways

• A shortcut can carry a command line. Microsoft documents that a shell link stores a target path, command-line arguments, a working directory, a window state and an icon location, so a "document" icon can front a script interpreter.
• Delivery hides the file type. LNK files usually arrive inside ZIP archives, ISO or other disk images, or are assembled by HTML smuggling, so that gateway filters and MotW are weaker or absent.
• The UI can mislead even a careful user. ZDI advisory ZDI-25-148 (ZDI-CAN-25373, CVE-2025-9491) describes crafted LNK data that hides hazardous content from a user inspecting the file through the Windows interface; Microsoft assessed it as not meeting its servicing bar.
• Block at the edge, constrain at the endpoint. Microsoft's default common attachments filter already includes lnk, iso and img; pair it with archive inspection, ASR rules, script control and application control.
• Detect the child process, not the shortcut. The reliable signal is explorer.exe launching a script engine or system binary with long or obfuscated arguments shortly after a user opened an archive or mounted an image.

What it is

Microsoft defines a shell link as a data object that gives access to another object in the Shell's namespace, such as a file, folder, drive or printer; a shortcut is a shell link with an icon, stored in a binary file with the .lnk extension. The open specification [MS-SHLLINK] describes the binary format: a fixed header, an optional target ID list, optional link information, optional string data (including the name, relative path, working directory, command-line arguments and icon location), and extra data blocks. Windows hides the .lnk extension even when "show file extensions" is enabled, which is one reason shortcuts are effective lures.

Legitimate shortcuts are everywhere: the Start menu, the desktop and the Startup folder are full of them. A malicious LNK file differs only in what it points to and how it is presented. MITRE ATT&CK lists .lnk among the file types used for User Execution: Malicious File (T1204.002), and separately tracks shortcut abuse for persistence (T1547.009 Shortcut Modification) and use of the icon location field to fetch payloads (T1027.012 LNK Icon Smuggling).

How it works

At a defensive level, malicious shortcut chains follow a recognisable pattern.

Delivery in archives and disk images

A bare .lnk attachment is easy for a gateway to block, so attackers wrap it. Common wrappers are ZIP and other archives (often password-protected, with the password in the email body), ISO, IMG and VHD disk images, and HTML files that assemble the archive in the browser (T1027.006 HTML Smuggling). CISA's #StopRansomware Guide warns that password-protected archives can evade antivirus and email filters. See the ISO and Container File Malware Delivery Guide and the HTML Smuggling Guide.

Mark-of-the-Web and SmartScreen

When a file is downloaded from the internet or saved from an email attachment, Windows records its origin in an NTFS alternate data stream called Zone.Identifier; Microsoft documents ZoneId 3 as the Internet zone and notes MotW exists only on NTFS. Office, SmartScreen and Attachment Manager use that marker to decide whether to warn or block. ATT&CK T1553.005 Mark-of-the-Web Bypass describes how container formats are abused: the container is marked, but files inside may not inherit the mark after extraction or mounting, so they are treated as local. Windows and archiving tools have improved MotW propagation over time, and Microsoft has patched several MotW and SmartScreen bypasses that CISA lists as known exploited, including CVE-2022-41091 (MotW security feature bypass), CVE-2024-21412 (Internet Shortcut files, a related .url format) and CVE-2024-38213 (SmartScreen). Microsoft also states that SmartScreen does not protect against malicious files on internal locations or network shares, which matters when shortcuts are placed on file shares or removable media.

Hidden arguments: ZDI-CAN-25373

Trend Micro's Zero Day Initiative published advisory ZDI-25-148, "Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability" (ZDI-CAN-25373, CVE-2025-9491, CVSS 7.0). The advisory states that crafted data in a .LNK file can make hazardous content invisible to a user who inspects the file through the Windows user interface, and that user interaction is required. ZDI reported it to Microsoft on 20 September 2024; Microsoft assessed it as not meeting its servicing bar and maintained that view in March 2025. NVD classifies it as CWE-451, UI misrepresentation of critical information. The defensive point is simple: checking a shortcut's properties dialog is not a reliable test, so controls must act on what the shortcut actually executes. Check Microsoft's current guidance for any later change in Windows behaviour.

Why it matters

Microsoft changed Office to block VBA macros in files from the internet by default, starting with Current Channel version 2206 on 27 July 2022 and reaching Semi-Annual Enterprise Channel in January 2023. That removed the most common first-execution trigger for loaders such as Emotet and QakBot, and attackers shifted to formats that still execute on a double-click: shortcuts, scripts, disk images, OneNote attachments and HTML smuggling. See the Macro Malware Guide and the Office Macro Blocking Guide. A shortcut is usually only the first link in a longer chain that ends in a loader, an infostealer or ransomware, so stopping it is cheap compared with responding to what follows. See the Malware Loaders and Droppers Guide.

Defences

Rolling out the controls:

1. Confirm the email gateway blocks .lnk, .iso, .img and .vhd, and test whether it inspects inside ZIP and password-protected archives.
2. Inventory legitimate business uses of shortcut and disk image files arriving from outside (rare in most organisations) and agree exceptions.
3. Deploy the script and prevalence ASR rules in audit mode for two to four weeks; review 1122 events and add narrow per-rule exclusions only.
4. Move rules to block for a pilot ring, then all devices. Roll back by returning a rule to audit through the same management channel.
5. Change script file associations so double-clicking .js, .vbs or .hta opens a text editor, and disable Windows Script Host where it is not needed.
6. Enforce application control on user-writable paths and add detections for the behaviours below.

Detection: alert on explorer.exe spawning PowerShell, cmd.exe, wscript.exe, cscript.exe, mshta.exe or rundll32.exe with long, encoded or whitespace-padded command lines; on processes started from a mounted disk image or a temporary archive extraction folder; and on new .lnk files in Startup folders. Collect process creation with full command lines (Security event 4688 with command-line auditing, or Sysmon event 1) and ASR events 1121, 1122 and 1129 from the Microsoft-Windows-Windows Defender/Operational log. See the EDR Guide and the Living off the Land Guide.

Metrics:

• Number of .lnk, .iso, .img or .vhd attachments delivered to mailboxes per month (target zero).
• Percentage of endpoints with the script ASR rules in block mode.
• Number of explorer.exe to script engine alerts and the percentage triaged within one hour.
• Percentage of tested archive tools that propagate MotW to extracted files.
• Phishing simulation report rate for archive-wrapped shortcut lures. See the Phishing Simulation Programme Guide.

Common misconceptions

• "A shortcut is not an executable, so it is harmless." A shortcut is an instruction to run something; what matters is its target and arguments.
• "Users can check the properties first." The target field shows a limited view, and ZDI-25-148 describes crafted files that hide hazardous content from the Windows interface.
• "The gateway blocks .lnk, so we are covered." Shortcuts arrive inside archives, disk images and HTML smuggling payloads that a gateway may not unpack, and on USB drives and file shares that it never sees.
• "MotW will warn the user." Files inside some containers lose the mark, MotW is NTFS-only, and SmartScreen does not cover internal shares.
• "Blocking macros solved document malware." It moved attackers to other formats, LNK prominent among them.

Related concepts

Framework mapping: NIST CSF 2.0 PR.PS-05 (unauthorised software execution is prevented) and DE.CM; NIST SP 800-53 Rev. 5 SI-3 Malicious Code Protection, SI-8 Spam Protection, CM-7(5) allow-by-exception and SI-4 System Monitoring; CIS Controls v8.1 Control 9 (email and web browser protections, including 9.6 block unnecessary file types) and Control 10 (malware defences); ISO/IEC 27001:2022 Annex A 8.7 Protection against malware.

Practitioner checklist

• Block .lnk, .iso, .img and .vhd attachments, and confirm archive contents are inspected.
• Quarantine password-protected archives from external senders.
• Test that your archive tools and Windows build propagate MotW to extracted and mounted files.
• Set SmartScreen to block on managed devices and stop users removing zone information.
• Enable script and prevalence ASR rules (audit, then block) or EDR equivalents.
• Disable Windows Script Host where unused and change script file associations to open in a text editor.
• Alert on explorer.exe launching script engines or LOLBins with long or encoded arguments.
• Monitor Startup folders for new or modified shortcuts.

Standards and references

• Microsoft Learn: Shell Links
• Microsoft: [MS-SHLLINK] Shell Link (.LNK) Binary File Format
• Zero Day Initiative: ZDI-25-148 Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability
• Microsoft Learn: Macros from the internet are blocked by default in Office
• Microsoft Learn: Anti-malware protection in EOP
• Microsoft Learn: Attack surface reduction rules reference
• MITRE ATT&CK: Subvert Trust Controls: Mark-of-the-Web Bypass
• CISA: #StopRansomware Guide

Related NHI Mgmt Group resources: Malware Guide · Macro Malware Guide · ISO and Container File Malware Delivery Guide · HTML Smuggling Guide · Email Security Guide