Windows shortcuts can potentially be dangerous if their target or icon attributes are modified by a cybercriminal. A shortcut's target can be changed to point to malicious files like cmd.exe instead of the original target. The icon can also be modified to disguise the real target. For example, a shortcut could be crafted to pose as a document but actually execute commands when clicked, enabling attacks like getting remote access to the system. Users should avoid running shortcuts from untrusted sources without inspection.

1. The shortcuts of
Windows
can they be dangerous?

2. Shortcuts are files that point to
other files.
Through them, we can access a file
without being in the same folder, for
example.

3. If we open the properties of a shortcut file (.lnk), we can see some attributes that can be
modified such as Run, Comment, Target, and Icon.
All right so far, these attributes receive a value automatically as soon as you create a
shortcut, for example: when you create a shortcut to a common .txt text file, the
shortcut assumes the same icon as that file, but as we can see, it is possible to modify
this icon to any other on our computer.
What's more, we can also modify the target file, and save that information.

4. But then where
does danger live?

5. At first, these attributes seem harmless, however,
with the possibility to change the target file and
shortcut icon to anyone on the machine, a
cybercriminal can use these features of a shortcut
file to create social engineering, let's see an
example. But then where does danger live?

6. A shortcut was created on the desktop for the Documents
folder, after which the Target attribute was changed to the
cmd.exe path, in this way it is possible to execute commands
on the system.

7. But see that the shortcut took over the cmd icon, that's not what we want,
we can modify the icon to something more convincing, so we click Change
Icon and choose an icon in the system.
Now the shortcut doesn't point to Documents, but to cmd.exe which then
executes a command on the machine. This can be used to get a reverse
shell, or else do some damage to your computer.

8. It's like
prevent?

9. Never run .lnk files downloaded from the
internet without first analyzing them.
For example, let's say you downloaded a .zip
file and when you extract the file you find a
shortcut to your Desktop. This shortcut could
just be a malicious file, malware camouflaged
as .lnk.