The Explorer Trap: How Hackers Turn Windows File Explorer into a Silent Portal for Remote Access Trojans

Cofense Intelligence uncovered a growing campaign that leverages WebDAV support in Windows File Explorer and malicious .url/.lnk shortcuts to silently download Remote Access Trojans (notably XWorm, Async RAT, and DcRAT). Attackers host WebDAV servers on legitimate Cloudflare Tunnel demo domains to evade detection, exploit UNC shortcut behavior that can beacon to infrastructure without user clicks, and primarily target European corporate users using invoice-themed lures.