Tactic or Technique: LNK

Attackers use LNK files, or Windows shortcuts, as a stealthy way to deliver malware. These files often look like regular documents and use familiar names like “Invoice_details.lnk” or “Contract_review.lnk” to get you to open them. But instead of opening a document, they quietly run commands in the background using tools like PowerShell or CMD.

You might receive an LNK file as an email attachment or inside a ZIP archive, sometimes with a password to avoid detection. When you click it, the file can connect to an attacker-controlled server, download more malware, or start stealing data without giving you any clear warning. While email providers typically block LNK files as direct attachments, they can still be delivered via URL file downloads and other techniques like link-based HTML smuggling.

This technique has been used by a range of threat actors, from sophisticated groups to commodity malware campaigns. It’s been part of attacks involving Emotet, Qakbot, and IcedID, and remains a reliable way for attackers to get around defenses that don’t closely inspect shortcut behavior.