For 8 years, Microsoft ignored this vulnerability. 11 nation-state hacking groups used it. Microsoft quietly patched it recently.
CVE-2025-9491.
The dreaded Windows shortcut trick
Every Windows shortcut file (.lnk) has a Target field. When you right-click and check Properties, Windows shows you what the shortcut actually runs, but not the whole thing.
Windows only displays the first 260 characters. The actual command can be up to 32,000 characters.
Attackers discovered they could pad the beginning with whitespace characters, spaces, tabs, and etc. Your goal is to push it so far no one can see it.
You double-click. Then press F for respect.
Attacker creates .lnk file that looks like a PDF or Word document
Target field starts with thousands of invisible whitespace characters
Malicious PowerShell commands hidden after the whitespace
Check Properties, see nothing dangerous
Open it, malware executes
Even if you select all and scroll, you still can't see it. The UI cuts off at 260 characters.
11 state-sponsored APT groups
Nearly 1,000 malicious samples
Targets: governments, military, energy, telecommunications, diplomats, you and me
Trend Micro's Zero Day Initiative reported this to Microsoft in March 2025. Microsoft's response: "Does not meet the bar for immediate servicing."
Translation: We don’t care.
2017- First attacks detected using this technique
March 2025- Trend Micro publicly discloses the issue
March 2025- Microsoft refuses to patch
October 2025- Attackers use it against European diplomats
December 2025- Security researchers notice the fix
No security advisory. No CVE acknowledgment.
The malware is PlugX. A remote access trojan that's been around since 2008. Still effective because it keeps evolving and Microsoft is incompetent.
https://nvd.nist.gov/vuln/detail/CVE-2025-9491
