Planting malicious shortcut files for credential harvesting

Plant a Windows shortcut (.lnk) in a user-accessible share with its icon location pointing to a controlled remote SMB or WebDAV resource. When the target user's shell opens the location or enumerates the shortcut icon, Windows may attempt outbound authentication to that resource. This coerces authentication; it does not by itself execute the shortcut target or deliver a payload. Whether a response is observed depends on share access, Windows remote-icon policy, network egress, NTLM configuration, and a controlled receiving endpoint.