Security researcher Nafiez has revealed an unpatched vulnerability in Windows LNK (shortcut) files that enables remote code execution without user interaction. The flaw, which exploits the structure of LNK files using manipulated EnvironmentVariableDataBlock and UNC paths, can silently trigger network connections simply when a user opens a folder containing the malicious file. Despite a working proof-of-concept being released, Microsoft has declined to patch the issue, claiming it doesn't meet their security threshold—raising concerns due to the attack’s stealthy, clickless nature.

‍