VHDX is a file format for virtual hard disks used by Windows and virtualization software. Windows can mount a VHDX as a drive, exposing its files and folders without requiring a physical disk. The format is commonly used for virtual machines, backups, and portable disk images.
In cyber security, a VHDX can also serve as a container for malicious files. An attacker may disguise a disk image as a document or other expected attachment; once mounted, it can present shortcuts or installers that lead to further execution. Defenders should treat unexpected disk images cautiously, inspect their contents in a safe environment, and monitor for suspicious mounting followed by shortcut launches or installer activity.