Browser shortcut hijack co-launching CountLoader via conhost --headless (correlated)

Duo Tech@duotech

•updated Aug 6, 2026•3•0•0

Detects correlated activity where a browser shortcut (.lnk) file is modified/renamed and, within a 15-minute window on the same host, conhost.exe is spawned with --headless and a cmd.exe/cmd "/c start" command line, indicative of shortcut hijacking used to covertly relaunch a payload such as CountLoader.