Phishing emails abuse Windows search protocol to push malicious scripts

A phishing campaign uses HTML attachments (inside small ZIPs) that leverage the Windows Search protocol (search-ms URI) to point Explorer at attacker-controlled, Cloudflare-tunneled file shares; the search displays a fake invoice LNK that, if clicked, executes a BAT hosted by the remote server. Trustwave observed this technique in the wild, couldn't retrieve the payload (server was down), and recommends careful mitigation such as removing search-ms/search protocol registry entries, noting this may break legitimate functionality.