LNK-Spawned Hidden PowerShell Downloader via dl.php NFe Lure

Ibrahim Saud@tektrix

•updated Sep 22, 2026•4•0•6

Detects the execution of PowerShell via a shortcut (.lnk) file that attempts to download and execute remote content using 'Invoke-WebRequest'. The command lines use common obfuscation techniques like 'Hidden' window style and 'Bypass' execution policy, targeting specific known malicious URL patterns or filename keywords.