MastaStealer Exploits Windows LNK to Launch PowerShell and Bypass Defender

MastaStealer exploits Windows LNK files to launch PowerShell and bypass Defender, according to GBHackers On Security. The campaign starts with a spear-phishing email containing a ZIP archive that holds a single .lnk file; when opened, the LNK file launches Microsoft Edge and navigates to a typosquatting variant of anydesk[.]com in the foreground, while the malware silently downloads an MSI installer from anydesk[.]net.

After the MSI installs, the payload drops a file named dwm.exe to the local user’s AppData path, which functions as the C2 beacon, with deployment relying on a Windows Installer event that showed failure when the user lacked local administrator privileges and triggered Application Event ID 11708. A PowerShell command executed during MSI installation adds a Defender exclusion for C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\dvm.exe, helping the attackers conceal the beacon and maintain persistence.

The campaign communicates with two C2 domains, cmqsqomiwwksmcsw[.]xyz and ykgmqooyusggyyya[.]xyz, which use randomised naming to evade detections. Detection guidance includes watching for LNK file execution, suspicious PowerShell commands targeting security exclusions, and unsigned MSI installations, with emphasis on Defender exclusions and Windows Installer logs as critical indicators.