LNK File Masquerading as PDF Spawns PowerShell (VelvetCake Downloader)

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•5

Detects instances where PowerShell is initiated via LNK files, specifically targeting PDF LNK attachments or known malicious script naming patterns (update1.vbs, update2.ps1) and common downloader cmdlets (e.g., IEX, Invoke-WebRequest). It also includes specific indicators for remote file downloads.