A Windows Internet Shortcut is a .url file that stores a web address. When opened, Windows passes the link to the associated browser or handler. Unlike a document containing a copied URL, the shortcut is a file that can be delivered as an attachment or download and may direct a user to a remote site or resource.
In attacks, a shortcut can be used as one step in a delivery chain-for example, to lead toward a script or PowerShell stager. Its presence alone does not prove that the link was opened or that code executed. Defenders can inspect shortcut contents, restrict or warn about risky downloads, and correlate file and link activity with endpoint process and network logs to establish what happened.