Hackers Deploy Invisible Remcos RAT Using LNK Files and PowerShell Magic

Hackers Deploy Invisible Remcos RAT Using LNK Files and PowerShell Magic

• Emerging Threat: A new campaign uses Windows shortcut (LNK) files and PowerShell to deliver malware.
• Key Players: The attackers install Remcos RAT, which gives them broad control of a PC while avoiding detection.
• Security Implications: Home users, businesses and government agencies are all at risk.

Attackers are using Windows shortcut (LNK) files and PowerShell scripts to install Remcos RAT (Remote Access Trojan), according to research published by Qualys in May 2025. The method lets them control infected machines quietly. Most of the attack runs in memory, so there’s little on disk for antivirus to catch.

How the attack works

What is Remcos RAT?

Remcos started out as a legitimate remote administration tool, and criminals have adopted it widely because it gives an attacker extensive control of a compromised computer, from logging keystrokes and capturing the screen to running commands remotely, all wrapped in features designed to keep it hidden from the person using the machine.

From shortcut to shell

The attack starts with an LNK file, the Windows shortcut format, which can run commands when clicked. Qualys found the shortcut arriving inside a ZIP archive and launching mshta.exe, which pulls down a remote script that in turn runs an obfuscated PowerShell loader. That loader decodes shellcode and runs Remcos in memory. This ‘fileless’ approach is hard for traditional antivirus to spot because there’s no obvious malicious file to scan.

Why fileless attacks are spreading

Hiding in built-in tools

Fileless attacks that abuse built-in Windows tools are becoming more common. Defenders can’t simply block PowerShell or mshta. Admins need them.

The risks go beyond home PCs. Remote access tools like Remcos are also used for corporate espionage and attacks on government networks, where confidential data is the target.

How security vendors are responding

Security firms are improving detection, with more behavior-based analysis and stronger endpoint protection aimed at fileless techniques. Vendors such as Trend Micro and Kaspersky publish threat intelligence on these campaigns. Those defenses only work if they are kept up to date and actually deployed.

Steps to take now

Hardening against shortcut lures

Keep systems updated. Train staff to be suspicious of unexpected ZIP files and shortcuts. Turn on PowerShell logging so defenders can see what scripts are doing, and use endpoint protection that watches behavior, not just files.

Keeping up with attackers

Defenses have to keep improving. Share what you learn.

The bigger lesson

Delivering Remcos RAT through LNK files and PowerShell is a warning. It’s also a useful lesson, pushing defenders toward detection that watches what processes actually do in memory instead of waiting for a known-bad file to land on disk. Attackers keep finding new ways in.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.