US EditionPublished • loading... • Updated
Microsoft Fixes Windows Shortcut Flaw Exploited for Years
Microsoft fixed a Windows shortcut flaw exploited in nearly 1,000 samples since 2017 that allowed hidden command execution by attackers, including state-sponsored groups.
- On November 12, Microsoft released a patch fixing 63 vulnerabilities, including the Windows LNK UI flaw tracked as CVE-2025-9491 with a 7.8 severity score.
- Trend Micro researchers reported nearly a thousand malicious samples dating back years ago, while Zero Day Initiative repeatedly sought a fix Microsoft called 'low severity'.
- By hiding arguments with non-printing characters, attackers padded command-line arguments with whitespace or non-printing characters so the Target field appears harmless, enabling hidden execution in the current user context.
- Patch-Watcher 0patch reported Microsoft rolled out a silent mitigation so the Properties dialog now reveals the full command, but defenders warn many affected Windows machines may remain compromised.
- The LNK format proved valuable because short files bypass many filters yet enable full remote code execution; Arctic Wolf Labs reported UNC6384 used CVE-2025-9491 in spear-phishing with PlugX in Europe.
Insights by Ground AI
Podcasts & Opinions
11 Articles
11 Articles
Referenced under the technical name CVE-2025-9491, a flaw in Windows (.lnk) shortcut files has been exploited for years by espionage groups and cybercriminals, for their ability to inject malicious code in a hidden way. We are in 2017, and for the first time, Trend
Coverage Details
Total News Sources11
Leaning Left0Leaning Right0Center2Last UpdatedBias Distribution100% Center
Bias Distribution
- 100% of the sources are Center
100% Center
C 100%
Factuality
To view factuality data please Upgrade to Premium
