WietzeFeb 12

Can LNK files ever be trusted?

āš” My latest blog post demonstrates several new LNK abuse methods, allowing you to fully spoof the target an LNK file shows in Explorer. It also introduces a tool to create your own LNKs, and a tool to detected spoofed ones yourself.

šŸ¬ https://www.wietzebeukema.nl/blog/trust-me-im-a-shortcut

Show threadCravateRouge

@wietze Very interesting read! Just when I wanted to learn more about LNK.

Do you also have an idea about what CVE-2026-21510 is about? Apparently it's related to .url/.lnk

Feb 13 at 4:55amWeb
Show threadWietzeFeb 13

@CravateRouge ah interesting, I hadn't seen this one yet. Looks like it allows for Windows Smartscreen (i.e. the MotW dialog) to be bypassed:

> An attacker could bypass Windows SmartScreen and Windows Shell security prompts by exploiting improper handling in Windows Shell components, allowing attackerā€‘controlled content to execute without user warning or consent.

Show threadCravateRougeFeb 13
@wietze Yes, it was apparently delivered through .lnk