Execute Polyglot LNK Payload

An adversary can use a Windows Shell Link (.lnk) file appended with HTA content and disguised as a familiar document or image. When a user opens the shortcut, Windows follows its configured target, which may invoke mshta.exe on the same polyglot so the HTA handler processes the appended content and starts code. Delivery and follow-on behavior are campaign-specific; this maps to ATT&CK T1204.002 because execution depends on the user opening a malicious file.