CVE-2025-9491 is a now-patched Windows shortcut vulnerability (ZDI-CAN-25373) that allows remote code execution. Addressed by Microsoft in November 2025 Patch Tuesday, it was weaponized by over a dozen hacking groups since 2017. Armored Likho abused this flaw to execute obfuscated PowerShell commands as part of their attack chain.