Fast Facts

• Microsoft patched a Windows shortcut (LNK) vulnerability in late 2025 after it was abused for eight years.
• The flaw allowed attackers to hide malicious commands in shortcuts, evading user detection.
• At least eleven nation-backed hacking groups from China, Iran, and North Korea exploited the bug for espionage and data theft.
• Victims included European government and diplomatic institutions, with malware like PlugX and XDigo deployed in targeted attacks.
• Microsoft downplayed the risk for years, citing user warnings, before quietly expanding shortcut transparency in a November update.

The Shortcut That Opened Doors

Imagine a locked door with a hidden gap beneath it - just wide enough for a letter, or a snake, to slip through. For eight years, a similar gap in Windows allowed some of the world’s most sophisticated cyber spies to sneak past digital defenses. The culprit? Not some high-profile backdoor, but the humble Windows shortcut, or LNK file - those familiar icons that launch programs or documents with a click.

In November 2025, Microsoft finally patched a flaw now labeled CVE-2025-9491. The vulnerability had existed since at least 2017, lurking in the way Windows displayed shortcut properties. Hackers realized they could stuff malicious commands deep inside a shortcut’s settings, hiding them beyond what users or administrators could see. When someone clicked the shortcut, the hidden code would execute - often without the faintest suspicion.

Espionage in Plain Sight

According to reports from security outfit 0patch and others, eleven state-sponsored hacking groups from China, Iran, and North Korea made this trick their own. Their targets? Primarily diplomats and government agencies across Europe and beyond. The shortcuts, sometimes disguised as harmless documents, could quietly steal sensitive files, open backdoors, or siphon off confidential emails.

One notorious group, XDSpy, used the flaw to spread their XDigo malware in attacks on Eastern European officials. By autumn 2025, Arctic Wolf researchers traced a new wave of attacks to Chinese groups leveraging the same vulnerability to implant the PlugX trojan - a tool closely tied to Chinese espionage campaigns - inside diplomatic networks.

Despite mounting evidence, Microsoft long maintained that the issue was not critical. Their reasoning? Users would see warnings before opening suspicious shortcut files, and many Office applications already blocked LNK files by default. Yet, as 0patch revealed, the technical reality was more slippery: Windows only displayed the first 260 characters of a shortcut’s command, hiding the rest. Malicious actors could bury their payloads where no warning could reach.

Lessons from a Silent Fix

After years of exploitation, Microsoft’s November 2025 update finally expanded the shortcut property window, ensuring that the full command - no matter how long - was visible. The fix arrived quietly, with little fanfare and no direct admission of the flaw’s seriousness. Third-party researchers had already offered temporary solutions, such as warning users when shortcuts contained hidden commands.

This episode is a telling reminder: sometimes, the most dangerous vulnerabilities are those hiding in the open, overlooked because they seem too mundane. In cyber espionage, even the smallest cracks can become doors for the world’s most determined spies.

WIKICROOK

• LNK File: An LNK file is a Windows shortcut that links to a file or program. Attackers can exploit LNK files to run hidden commands or malware.
• Zero: A zero-day vulnerability is a hidden security flaw unknown to the software maker, with no fix available, making it highly valuable and dangerous to attackers.
• State: A 'state' in cybersecurity refers to a government backing or conducting cyber attacks to gather intelligence or disrupt adversaries for political or strategic gain.
• PlugX: PlugX is a remote access trojan (RAT) that lets attackers control infected computers, often used in cyber espionage and data theft.
• Patch Tuesday: Patch Tuesday is Microsoft’s monthly event for releasing security updates and patches to fix vulnerabilities in its software, typically on the second Tuesday.