Cofense Intelligence has identified a growing tactic in which threat actors abuse Windows File Explorer and WebDAV to deliver malware outside of traditional browser-based downloads. By leveraging URL and LNK shortcut files along with Cloudflare Tunnel infrastructure, attackers are disguising remote file servers as seemingly local resources and delivering multi-stage campaigns that frequently end in RAT infections. This report breaks down how the technique works, why it is effective, and what organizations can do to detect and mitigate this evolving threat.

The post Abusing Windows File Explorer and WebDAV for Malware Delivery appeared first on Security Boulevard.

Cofense

Source: Security Boulevard
Source Link: https://securityboulevard.com/2026/02/abusing-windows-file-explorer-and-webdav-for-malware-delivery/