Attackers found a way to attack Windows users using desktop shortcuts. This was reported by BleepingComputer.

Experts noticed that hackers started modifying .lnk files to use them for remote attacks on users. .lnk extensions often have shortcuts – system files used to direct the user to a specific program or folder.

ESET experts said that unknown people changed the static link in the shortcut settings to an updated link that launches a remote script. Typically, in this case, the program that the shortcut points to did not start. During the attack, the attackers used the Emotet botnet, which is necessary to activate various viruses.

According to experts, the effectiveness of the botnet has increased significantly in recent days. ESET telemetry data showed that the new method was most frequently used by attackers to attack Windows users from Mexico, Italy, Japan, Turkey and Canada.