■■□□□ While not new, a self-referencing LNK file in combination with winget configuration instructions can be a viable initial access payload for environments where the Microsoft Store is not disabled.
https://blog.compass-security.com/2026/03/winget-desired-state-initial-access-established/