Tax Phishing - Suspicious LNK Launching PowerShell

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

Detects Windows Explorer executing an LNK file that directly spawns PowerShell to download the next-stage tax lure payload. This pattern is indicative of a phishing attack attempting to deliver malicious content.