Categories: Malware

New Malicious Macro that Hijacks your Windows Desktop Shortcuts and Points to Download Malware

Cybercriminals using a malicious macro that changes the target of Desktop Shortcuts to download malware and when the user clicks on the altered shortcut file, the malware executes.

With this new campaign, attackers used common tools like WinRAR, and Ammyy Admin to gather information instead of their own tools.

Security researchers from Trend Micro uncovered the new campaign, the malware and macro are not sophisticated and researchers believe that malware development was not yet completed.

Malicious Macro Infection Chain

The attack starts with a malicious word document that contains contents written in Russian with a house image and it instructs users to enable macro’s to get the full document.

Once the user enables macro it searches for the shortcut files in desktop and replace’s with the corresponding linked files. It primarily targets file shortcut files that include Skype, Google Chrome, Mozilla Firefox, Opera, and Internet Explorer.

malicious macromalicious macro

If the user executes the shortcut from the desktop shortcut or Quick launch bar it executes the malware instead of the original file.

Once the malware triggered it drops WpmPrvSE.exe in system32 or SysWoW64 depending on the operating system type and it starts up a service called WPM Provider Host, which allow’s application on your computer to request system information.

Along with WpmPrvSE.exe it also drops a rar.exe, possibly for later use and then it recovers’s the shortcut files to its original state again.

Researchers say that “While the malware is working, the malicious service that the malware activated would already be downloading the final payloads. It downloads a RAR archive from Google Drive and GitHub.”

Malware infection chain

The download RAR archive contains config file, key, and other tools, the installer file run through the certutil command-line program and also it decodes the wsvchost[.]key the file which is the actually a well-known remote desktop utility Ammyy Admin.

By installing Ammyy Admin on user’s system and granting full permission to attackers ID via malware, an attacker could get full system access through Ammyy Admin. Trend Micro published a detailed analysis report.

Microsoft has macro’s disabled by default an it is not recommended to enable and download macro for documents form unknow resources. Also, Microsoft shows warning while enabling macros.

Researchers said the malware is not widely distributed and it is still in the PoC stage and will have further versions.

Also Read

60,000 Android Devices are Infected with Malicious Battery Saver App that Steals Various Sensitive Data

MyloBot – Highly Sophisticated Botnet Shutdown Windows Defender & Blocking Ports on the Firewall

GZipDe – A Sophisticated Malware Attack using Metasploit Backdoor with Encrypted Payload

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Zero-Trust Policy Bypass Enables Exploitation of Vulnerabilities and Manipulation of NHI Secrets

A new project has exposed a critical attack vector that exploits protocol vulnerabilities to disrupt…

11 hours ago

Threat Actor Sells Burger King Backup System RCE Vulnerability for $4,000

A threat actor known as #LongNight has reportedly put up for sale remote code execution…

11 hours ago

Chinese Nexus Hackers Exploit Ivanti Endpoint Manager Mobile Vulnerability

Ivanti disclosed two critical vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, affecting Ivanti Endpoint Manager Mobile…

11 hours ago

Hackers Target macOS Users with Fake Ledger Apps to Deploy Malware

Hackers are increasingly targeting macOS users with malicious clones of Ledger Live, the popular application…

11 hours ago

EU Targets Stark Industries in Cyberattack Sanctions Crackdown

The European Union has escalated its response to Russia’s ongoing campaign of hybrid threats, announcing…

15 hours ago

Venice.ai’s Unrestricted Access Sparks Concerns Over AI-Driven Cyber Threats

Venice.ai has rapidly emerged as a disruptive force in the AI landscape, positioning itself as…

15 hours ago