Phishing Campaign Abuses Windows Search to Distribute Malware

Trustwave researchers observed a phishing campaign delivering HTML attachments (often zipped and disguised as invoices) that abuse the Windows Search protocol to launch Explorer and present a shortcut (LNK) pointing to a remote batch (BAT) script; the attack relies on social engineering and user interaction to trigger subsequent malware installation, highlighting a deceptive technique that evades basic email scanners and exploits familiar OS behaviors.