Malicious LNK Files Disguised as Documents Deliver Fileless Malware

Threat actors are distributing malicious LNK files disguised as privacy consent forms and resumes to deceive users into executing them. Once opened, these files execute obfuscated PowerShell commands that download and run additional payloads using fileless techniques. The attacks aim to steal information and establish a backdoor for persistent access. Organizations are advised to enforce strict verification of file extensions and monitor PowerShell execution logs, Task Scheduler activity, and outbound connections. Users should be trained to validate incoming files before opening them. The attacks exploit common user behavior, making them particularly dangerous. Current investigations are ongoing to assess the full scope of the impact and identify affected systems. No specific numbers or CVEs were reported in the articles.

Key Points: • Malicious LNK files are disguised as legitimate documents to trick users. • The attack employs obfuscated PowerShell commands for fileless malware delivery. • Organizations must enhance user training and monitor suspicious activities.