Urgent Microsoft Windows Cyberattack Warning: Avoid Opening These Files

Microsoft Windows users have been urgently warned about a dangerous cyberattack that can exploit a longstanding, unresolved security flaw involving Windows LNK files. As per a report in Forbes, citing cybersecurity researchers at Kaspersky and Trend Micro, the vulnerability, known as ZDI-CAN-25373, is being actively exploited by cybercriminals to mount a series of attacks this year.

A malicious LNK file can exploit a Windows feature by including an attacker-controlled network location, targeting users across different VLANs. It exploits a flaw in Windows File Explorer, which does not fully display certain parameters included in shortcut files.

Despite the vulnerability existing for years, Windows has not assigned it a Common Vulnerabilities and Exposures (CVE) identifier that is typically used to acknowledge and track security threats. In a statement issued to the outlet, Microsoft claimed that its Defender includes content scanning functionality that examines files, including the LNK ones.

“We appreciate the work of ZDI in submitting this report under a coordinated vulnerability disclosure. Microsoft Defender has detections in place to detect and block this threat activity, and the Smart App Control provides an extra layer of protection by blocking malicious files from the Internet," Microsoft said in a statement.

"As a security best practice, we encourage customers to exercise caution when downloading files from unknown sources as indicated in security warnings, which have been designed to recognise and warn users about potentially harmful files." it added.

"While the UI experience described in the report does not meet the bar for immediate servicing under our severity classification guidelines, we will consider addressing it in a future feature release."

Despite Microsoft's assurance, the best protection against the flaw remains awareness and practising caution.

• Don't open LNK files from unverified sources.
• Ensure Microsoft Defender or the antivirus software remains updated.
• Pay attention to security warnings displayed by Windows.

Also Read | Woman Who Died For 8 Minutes Reveals What She Saw: "I Realised That..."

Google's advice to users

Recently, Google has also been urging its Gmail users to move on from older sign-in methods like passwords and two-factor authentication (2FA) to better secure their accounts. The tech giant told users to upgrade accounts to passkeys as well as social sign-ins, which use authenticated platforms like "Sign in with Google".

Passkeys is a login system that replaces passwords with biometric authentication via a trusted device like a smartphone. Google views passkeys as "phishing resistant", which can help users log in simply with the method they use to unlock their devices, which can include fingerprint recognition, facial scan, or the pattern lock.