The exploitation process is straightforward: attackers create a malicious file (such as a .docm file with dangerous macros), compress it into an archive, distribute it via phishing or compromised websites, and when victims extract it using WinZip, the extracted files execute without triggering the usual security warnings. Cybersecurity researchers have discovered a critical vulnerability in WinZip that enables attackers to bypass Windows’ Mark-of-the-Web (MotW) security feature, potentially allowing malicious code to execute without warning on victims’ computers. “When extracting files from an internet-downloaded ZIP archive, WinZip doesn’t propagate the MotW tag to the extracted files,” explained security researcher Enis Aksu, who discovered the vulnerability. Similar MotW bypass vulnerabilities have recently affected other popular archive utilities, including 7-Zip (CVE-2025-0411) and WinRAR (CVE-2025-31334), indicating a troubling trend in archive software security that attackers exploit. Mark-of-the-Web is a Windows security mechanism that flags files downloaded from the internet, triggering warnings when users attempt to open potentially dangerous content. “This allows dangerous files like macro-enabled Office documents to run without security alerts, creating a silent attack vector”. This vulnerability is particularly concerning because it allows attackers to bypass a fundamental Windows security control with minimal technical expertise.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 22 Apr 2025 03:00:12 +0000