The Dangers of Embedded LNK files in Office Documents

The report analyzes an in-the-wild attack using Office documents with embedded .lnk files that require user interaction to execute a PowerShell payload. The technique is notable for bypassing container- or VM-based sandboxes and achieving low antivirus detection; the vendor highlights behavioral detection alerts observed during a customer compromise and warns that embedded LNKs will likely be used to evade next-generation endpoint controls.