New Warning As Microsoft Windows Attacks Confirmed — No Fix Available

Updated November 2 with a statement from Microsoft regarding the newly reported CVE-2025-9491 Windows attacks.

No sooner has Microsoft issued an emergency security update for Windows users following attacks spotted in the wild, so news breaks of another ongoing cyberattack targeting Windows. This one, however, does not have a fix as of yet. Here’s what you need to know CVE-2025-9491.

Just as you might have thought that things were improving on the security front as far as Windows users were concerned, with new admin protections announced, and another year of free security updates for Windows 10 , comes the latest hammer blow: an active and widespread cyber espionage campaign exploiting what is now a critical vulnerability, with no Microsoft security patch to fix it.

A detailed and highly technical analysis from the cybersecurity boffins at Arctic Wolf Labs has confirmed that threat actors affiliated with China are currently exploiting a Windows remote code execution vulnerability, CVE-2025-9491, first reported in March, yes, March, in ongoing attacks.

The attacks appear to be targeting “European diplomatic entities in Hungary, Belgium, and additional European nations,” the analysis determined, but now that the exploit cat is out of the bag, it would not be at all surprising were this vulnerability to be used in much broader campaigns until Microsoft can fix it. So do not think that it does not concern you; it most certainly could.

The current attacks use a chain of phishing emails with an embedded URL that ultimately leads to malicious LNK files , or Windows shortcuts, being delivered to the target. By exploiting the vulnerability that allows obfuscated PowerShell commands to be executed and “extract and deploy a multi-stage malware chain,” Arctic Wolf said, “culminating in PlugX remote access trojan deployment,” the cyber damage is then done. I approached Microsoft for a statement and a spokesperson told me: “We appreciate the work of the research community in sharing their findings. Microsoft Defender has detections in place to identify and block this threat activity, and Smart App Control provides an additional layer of protection by blocking malicious files from the Internet. As a security best practice, we strongly encourage customers to heed security warnings and avoid opening files from unknown sources.”

Microsodft also comnfirmed that Windows identifies .lnk files as potentially dangerous, and attempting to open one downloaded from the Internet automatically triggers a security warning advising users not to open files from unknown sources, and we strongly recommend heeding this warning. Windows users are advised to block .lnk files from any untrusted source within their Windows Explorer settings.