A 7-Zip vulnerability can cause malware extracted from a specially crafted archive to lose Windows' Mark-of-the-Web (MotW) label. This issue has been tracked as CVE-2025-0411, impacting versions of 7-Zip prior to 24.09 and was added to CISA's Known Exploited Vulnerabilities catalog in February 2025. MotW is Windows metadata typically attached to files downloaded from the internet; it is stored in an NTFS Alternate Data Stream named Zone.Identifier, often with ZoneId=3, which identifies the file as originating from the Internet zone.
This vulnerability arises during extraction processes and can be exploited by malicious archives containing MotW (Most Wanted) signatures but failing to properly mark files extracted from nested archives, thereby circumventing security checks initiated by Microsoft's SmartScreen feature.
Security researchers attributed the exploitation of a flaw to phishing campaigns that used nested archives and deceptive filenames to deliver SmokeLoader malware. Administrators must recognize the significance of 7-Zip in managing software inventories and ensure that downloaded content retains security metadata for enhanced phishing resilience and endpoint hardening measures. Conversely, removing or losing MotW does not render the payload safe from Defender, EDR telemetry, email filtering, or application-control policies, as stated by the incident.
Keeping third-party extraction software up-to-date secures this specific path, ensuring SmartScreen remains an effective barrier against internet threats.
