A Hidden Door in Windows: How Attackers Can Blind Security Software to Malware

Key points

• Bitdefender researchers published findings showing how Windows bind links can hide malware from endpoint detection software.
• Bind links are a legitimate Windows feature that can be abused to create two conflicting views of the same file system.
• Endpoint detection and response tools, the software security teams use to watch for malicious activity on computers, can be fooled into scanning the wrong location.
• No patch has been named; the technique exploits intended Windows functionality, not a traditional software flaw.

Your company's security software watches every folder on your computer. It logs what opens, what runs. That watchfulness is the whole point. But Bitdefender researchers have found a way to point those watchful eyes at the wrong place entirely.

The trick uses something called bind links. A bind link is a built-in Windows feature, completely legitimate, that lets one folder appear to exist at a different location simultaneously. Think of it like a post-office redirect: mail sent to your old address quietly arrives at your new one. The attacker places malicious software in a location the security tool monitors, then uses a bind link to redirect where the file actually executes from. Scanning the decoy location, the security tool sees nothing harmful and waves it through. Malware runs from the real location, unseen.

How worried should businesses be?

Attentive, not panicked. This technique requires the attacker to already have a foothold on the target machine, which is a meaningful bar. Getting through the door still requires the usual tricks: a phishing email, a stolen password, or an unpatched vulnerability in internet-facing software.

Once inside, though, bind link abuse gives an attacker a reliable way to stay hidden. That matters. Most serious breach damage happens not at initial entry but during the days or weeks an attacker spends moving quietly through a network before anyone notices. We covered a related evasion approach on 9 July, when a signed Microsoft-approved driver was enabling 'GodDamn' ransomware to kill security tools outright; bind links are subtler but follow the same logic: neutralise detection before doing damage.

The broader problem is that bind links aren't a bug Microsoft can simply patch. They do exactly what they're supposed to do, which makes a clean fix complicated.

Security teams should pressure their endpoint detection vendors for specific guidance on whether their products are affected and what detection rules cover this class of abuse. Initial-access prevention remains the first priority: the bind link technique only matters if an attacker gets in at all.

Should your employees change how they work?

For most people the practical point is straightforward. Be suspicious of unexpected emails asking you to open files or click links. That's still how most attackers get their first foothold, and no amount of clever Windows trickery helps them if they never get past the front door.