Malicious Windows Shortcuts Use PowerShell and Node.js to Enable Remote Code Execution

A malicious Windows shortcut is being used to turn a routine download into a full remote-code-execution foothold.

The campaign begins with convincing booking-themed spam and steers victims toward a ZIP archive that conceals a booby-trapped LNK file.

One click can quietly start a chain that installs a backdoor and gives attackers a path to run further commands.

Instead of relying on a single malicious program, the operators combine built-in Windows tools with a legitimate Node.js runtime.

This makes activity harder to spot because PowerShell, node.exe, and standard web services can appear normal in isolation. The approach also enables persistence, encrypted communications, and delivery of additional files after the first compromise.

Analysts at LevelBlue identified the activity while investigating an alert in a customer environment.

LevelBlue said in a report shared with Cyber Security News (CSN). Their findings show a campaign designed to hide each stage until the victim has already launched the shortcut.

The exposure is significant for organizations that handle frequent external messages, particularly hotels and travel-related businesses that may expect reservation correspondence.

Researchers observed new samples daily and linked more than 400 of them to a shared machine identifier, suggesting a sustained operation rather than an isolated spam run. Early samples also appeared in comments on public discussion forums.

Malicious Windows Shortcuts Use PowerShell and Node.js

The ZIP archive contains a shortcut disguised as an image by borrowing an icon from shell32.dll. When opened, it runs a hidden PowerShell command rather than displaying a photograph.

The command uses large numbers and simple math to rebuild its next address, a trick that keeps the destination from being plainly visible in the shortcut.

That first script checks whether Node.js is available. If it is not, the attackers fetch a genuine Node.js package, unpack it under the user’s LocalAppData folder, then decrypt an encoded JavaScript payload. Using a trusted runtime lowers suspicion while providing the environment needed to launch the backdoor.

The JavaScript is heavily scrambled and uses a custom virtual-machine-style interpreter to process hidden instructions at runtime.

It checks for an existing dropped Node.js process, helping avoid duplicate copies, and creates a Run registry entry so it restarts when the user signs in. The process is launched detached, with its window hidden and output suppressed.

The backdoor can retrieve and run more content, including Windows executables, PowerShell, or JavaScript.

Before launching a downloaded executable, it verifies that the file resembles a valid Windows program and attempts to add an exclusion for its path in Microsoft Defender. Those actions can turn an initial shortcut click into broad control of the affected device.

Blockchain Retrieval Helps Backdoor Evade Disruption

Rather than storing a command-and-control address directly in the malware, the operators query a smart contract on the TON blockchain.

This EtherHiding method lets them change the destination without rebuilding the file, complicating blocking and takedown efforts. The backdoor then opens a WebSocket connection and uses key exchange and encryption.

Contract records revealed several previously used control domains, while payload-delivery and control servers sat behind Cloudflare.

Researchers also found recurring LNK names, including photo- and IMG-themed files, and a common MachineID value. Defenders should treat unexpected shortcut archives and booking links as suspicious, especially when they ask users to bypass download warnings.

Security teams can reduce risk by filtering or closely inspecting ZIP attachments and links from unverified senders, and by blocking unnecessary shortcut execution from email-originated files.

Monitoring for concealed PowerShell, new Node.js binaries in user folders, unusual Run registry entries, and requests to blockchain API services can help expose the chain early. Organizations should isolate affected systems and review related network activity promptly.

The campaign shows how familiar tools can be chained together to hide a serious intrusion. A harmless-looking image shortcut, a legitimate runtime, and a blockchain lookup each obscure a different part of the operation.

Prompt reporting of suspicious messages and preserving the original ZIP file can give incident responders the evidence needed to contain similar infections.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.