Windows shortcut (lnk) malware strategies

Intel Name: Windows shortcut (lnk) malware strategies

Date of Scan: July 3, 2025

Impact: Medium

Summary:
Attackers are increasingly leveraging Windows shortcut (.lnk) files as a stealthy malware delivery method. These files, designed to provide quick access to other files or programs, are being weaponized to execute malicious payloads while mimicking legitimate shortcuts. A sharp rise in malicious LNK samples—from 21,098 in 2023 to 68,392 in 2024—highlights their growing use. By analyzing 30,000 recent samples, researchers uncovered how LNK files enable threat actors to bypass traditional defenses, exploit user trust, and deliver malware effectively.

More Details