Windows can safeguard users against suspicious downloads before they run This article explores downloads run zip. . ZIP archives are frequently used in phishing campaigns.
An attacker sends a link or attachment that leads to an archive, persuades the recipient to extract it with 7-Zip, and relies on the unmarked file being launched without any security warnings. The report from Attackd, shared with ZeroOwl (ZeroOwl), revealed that while 7-Zip version 24.09 did not mark the Mark-of-the-Web tag on a downloaded ZIP archive, it failed to do so for the extracted executable. The behavior mirrors earlier archive-related MotW weaknesses, including the zero-day attack behind SmokeLoader, but this finding pertains to a default configuration rather than a newly assigned CVE.
However, the "Propagate Zone.Id stream" setting in 7-Zip defaults to "No," making it necessary to set it to "Yes" or use an Office-files option for proper metadata propagation. Researchers discovered that browser downloads, including those triggered by blob or data URLs, still carry the Internet-zone label in Chrome, Edge, Brave, and Firefox tests. Edge is more likely to make a quicker reputation decision during the download process, while other browsers rely on their own protection mechanisms at launch time.
Security teams must ensure endpoint configurations are validated, test representative archive and browser paths, implement endpoint monitoring, and instruct staff not to dismiss warnings as proof of safety.
