Threat actors are distributing malicious LNK files disguised as privacy consent forms to deceive users into opening them. When executed, these shortcut files launch obfuscated PowerShell commands that retrieve and run additional payloads using fileless techniques. The attack chain is designed to steal information and deploy a backdoor loader that helps preserve access and persistence.
The investigation showed that the LNK files embed obfuscated PowerShell code responsible for downloading follow-on scripts. These secondary scripts include a downloader that pulls payloads from legitimate web services and a loader that executes them directly in memory. The threat actor also abuses Windows Task Scheduler for persistence and uses decoy documents to make the malicious activity appear legitimate.
Organizations should enforce strict verification of file extensions and warn users LNK files disguised as regular documents. Security teams should closely monitor Task Scheduler activity, PowerShell execution logs, and outbound network connections. Users should also be trained to validate both the sender and the delivery path of any incoming file before opening it.
If this activity is detected, administrators should immediately review suspicious Task Scheduler entries and unusual PowerShell script creation in user-accessible directories. PowerShell logs should be analyzed, and external connections should be traced, especially those involving legitimate cloud platforms or web storage services. A full forensic investigation should then be performed on any identified malicious scripts and unauthorized network traffic.
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands: The adversary seeks to establish initial access and download a second-stage malware payload. To avoid detection by simple file scanners, they use a LNK (Shortcut) file. This LNK file is crafted to execute powershell.exe in a hidden window. The command passed to PowerShell uses Invoke-Expression and DownloadString to pull a script from a remote URL. This mimics real-world “Living-off-the-Land” (LotL) attacks where legitimate binaries are used to perform malicious actions, aiming to bypass traditional signature-based antivirus.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
