Microsoft mitigates Windows LNK flaw exploited as zero-day

A high-severity Windows LNK zero-day (CVE-2025-9491) has been exploited in the wild by numerous state-backed and cybercrime groups to hide malicious command arguments in .lnk shortcuts and deploy malware (Ursnif, Gh0st RAT, Trickbot, PlugX, etc.). Trend Micro and Arctic Wolf reported widespread exploitation across campaigns targeting diplomats and other victims; Microsoft appears to have silently mitigated display behavior in updates rather than issuing a full patch, and ACROS/0patch released an unofficial micropatch while the underlying attack vector requiring user interaction remains exploitable.