Windows LNK Spoofing: Exploit or Quirk?

Security researcher Wietze Beukema has documented four new techniques for manipulating Windows LNK shortcut files, showing how attackers can hide malicious payloads behind seemingly legitimate targets. While Microsoft insists these aren’t vulnerabilities, the findings highlight why LNK files remain a favorite tool for attackers.

How the Spoofing Works

• Conflicting target paths → Exploiting inconsistencies in how Windows Explorer prioritizes optional data structures.
• Forbidden path characters → Using double quotes and invalid paths to display one target while executing another.
• LinkTargetIDList manipulation → Executing a path different from what Explorer shows in the LinkInfo field.
• EnvironmentVariableDataBlock trick → Displaying a fake target (e.g., invoice.pdf) while executing PowerShell commands.

Result: Users see one path in the properties dialog, but the shortcut executes something entirely different—often with hidden command‑line arguments.

Why It Matters

• User deception: Explorer displays spoofed information instead of rejecting malformed shortcuts.
• Persistence of abuse: Attackers still rely on LNK files because users often click through warnings.
• Historical precedent: CVE‑2025‑9491, a similar flaw, was widely exploited by state‑sponsored groups (APT37, Mustang Panda, Kimsuky, etc.) before Microsoft quietly changed LNK behavior in 2025.

Microsoft’s Position

• Microsoft Security Response Center (MSRC) declined to classify the new techniques as vulnerabilities, arguing they require user interaction and don’t break security boundaries.
• Protections exist via Microsoft Defender and Smart App Control, which block malicious files from the Internet.
• Windows already flags .lnk files as potentially dangerous, prompting warnings when opened from untrusted sources.

Defensive Recommendations

• User training: Reinforce caution around shortcut files, especially from email attachments or downloads.
• Detection tools: Use Beukema’s open‑source suite lnk‑it‑up to identify suspicious LNK behavior.
• Endpoint monitoring: Watch for PowerShell execution or hidden arguments triggered via shortcuts.
• Policy enforcement: Restrict execution of LNK files from untrusted directories.

Final Thought

Whether or not Microsoft classifies these spoofing tricks as vulnerabilities, attackers clearly see value in weaponizing shortcuts. For defenders, the lesson is simple: treat LNK files with the same suspicion as executables, because in practice, that’s exactly what they are.