Shortcut to Compromise: LNK-in-Archive PowerShell Phishing

A finance clerk at Brightwater Logistics opens an invoice-themed ZIP and double-clicks a shortcut disguised as a document. The shortcut launches an obfuscated PowerShell loader that drops a CAB archive, expands it, runs a VBScript and batch chain, sets registry persistence, and beacons to attacker C2. Walk the mail gateway and endpoint logs step by step to trace the delivery, the loader, the persistence, and the callout.