David Driker

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions prior to June 2025 **Description** An issue exists in the WebDAV module where external control of file names or paths in Internet Shortcut Files allows an unauthorized remote attacker to execute arbitrary code. The flaw enables a working-directory hijack using a crafted `.url` shortcut to launch a legitimate signed Windows binary while pointing its working directory to an attacker-controlled WebDAV share. This technique can trick Windows into loading a malicious binary from the remote share instead of the legitimate one in System32, bypassing SmartScreen and Mark-of-the-Web security warnings. Real-world exploitation has been observed in phishing campaigns targeting users in Mexico via fake government ID-lookup sites to deliver infostealers. **Recommendations** Apply the Microsoft security update released in June 2025. Stop and set the WebClient service to Disabled on systems that do not require WebDAV. Disable Basic Authentication by setting `UseBasicAuth` to `0` and `BasicAuthLevel` to `0` in the registry settings.