{"id":11459,"date":"2025-07-22T12:31:49","date_gmt":"2025-07-22T05:31:49","guid":{"rendered":"https:\/\/infosec.new88088.net\/?p=11459"},"modified":"2026-06-25T09:59:46","modified_gmt":"2026-06-25T02:59:46","slug":"deerstealer-malware-campaign-when-harmless-file-shortcuts-become-data-steal-tools","status":"publish","type":"post","link":"https:\/\/infosec.new88088.net\/en\/2025\/07\/22\/deerstealer-malware-campaign-when-harmless-file-shortcuts-become-data-steal-tools\/","title":{"rendered":"DeerStealer malware campaign: When harmless file shortcuts become data steal tools"},"content":{"rendered":"
A new cyberattack operation has been discovered by cybersecurity experts, using a seemingly harmless Windows shortcut file (.LNK ), to spread malicious information theft DeerStealer<\/b>. The campaign was not only technically sophisticated but also hit a major flaw in user behavior, the habit of opening files of “reports,” “orders,” or “invoices” that are emailed without scrutiny.<\/b>
\n\u200b<\/div>\n
\n
\"1753175199674.png\"<\/div>\n<\/div>\n
\n

No specific attack group has claimed responsibility for the DeerStealer dispersal campaign. However, the sophistication of the techniques used suggests that this is a well-thought-out, deliberate campaign and aimed at individuals or organizations that own sensitive data, such as: Social media accounts, digital wallets, email accounts, or company-wide data.<\/p>\n

The attack begins with a shortcut file called “Report.lnk” which is disguised as a report or document. When clicked, the file silently activates an existing Windows tool called “mshta.exe” (which runs HTML applications) to execute hidden malicious code.<\/p>\n

This process doesn’t stop there. Mshta launches “cmd.exe” and then PowerShell, where a series of malicious code is decrypted step by step from Base64 encryption. Scripts were even designed to disable PowerShell’s logging and behavioral tracking, making detection nearly impossible with conventional security tools.<\/p>\n

One of the most sophisticated user tricks of this campaign is that as soon as you open the “.LNK” file, a fake PDF will be downloaded and opened in Adobe Reader. While the user was viewing the document, DeerStealer malicious code was silently written to the% AppData% directory and activated in the background.<\/p>\n

Malicious code download addresses are created from scrambled character sequences, which helps them avoid IOC (Indicators of Compromise) index-based filtering tools. The malicious code even tests the exact location of mshta.exe on each infected machine rather than using a fixed path, making detection even more difficult.<\/p>\n

Researchers from the malicious code analysis platform “ANY.RUN” tracked the entire attack sequence in real time and said:<\/p>\n<\/div>\n