New LNK Malware Uses Windows LOLBins to Evade Detection

Researchers at K7 Security Labs have uncovered a new wave of Windows shortcut (.LNK) malware that uses Living-off-the-Land Binaries (LOLBins) to evade detection, with the campaign first observed in Israel and distributed via Discord. According to K7 Security Labs, attackers deliver the LNK file named “Cyber Security.lnk” that opens a decoy PDF while silently executing a PowerShell command in hidden mode.

The script constructs directories, extracts an embedded PDF for distraction, and places a malicious ZIP containing Moq.dll in a hidden NuGet folder in the Public user directory, later deleting traces to stay covert. Execution then shifts to odbcconf.exe, a legitimate Windows binary, which silently registers and launches Moq.dll, a sophisticated Remote Access Trojan designed to issue commands from a C2 server and gather system information.

To avoid detection, Moq.dll patches AMSI in memory and disables ETW by modifying EtwEventWrite, while also loading supporting DLLs and decrypting PowerShell payloads for on‑the‑fly execution.