Windows can protect users before a suspicious download runs. But a newly documented 7-Zip behavior can remove an important warning layer and allow a malicious program to start without a Windows SmartScreen prompt.
ZIP archives are common in phishing campaigns. The gap grows when an archive looks like an invoice, update, or shared document.
An attacker sends a link or attachment that leads to an archive, persuades the recipient to extract it with 7-Zip, then relies on the unmarked file being launched.
This is not a newly disclosed exploit in 7-Zip code, but a security-control gap caused by the program’s default handling of download-origin metadata.
Attackd analysts identified the behavior while testing phishing delivery paths and endpoint protections.
Attackd said in a report shared with Cyber Security News (CSN) that 7-Zip 24.09 did not carry the Mark-of-the-Web tag from a downloaded ZIP archive to the extracted executable.
The finding raises social-engineering risk. A file may still face antivirus, endpoint monitoring, and other checks, but losing the SmartScreen reputation check removes one early decision point.
It also reinforces why teams should examine how tools behave together, as seen in reporting on Windows SmartScreen bypass attacks.
7-Zip Mark-of-the-Web Bypass
Mark-of-the-Web, often shortened to MotW, is Windows metadata attached to files obtained from the internet.
It is stored in a Zone.Identifier data stream and commonly records ZoneId=3, showing that the operating system treats the file as coming from the Internet zone.
The tag is not a detection engine by itself; it tells Windows and compatible security features to apply extra scrutiny.
When a tagged executable is double-clicked through File Explorer, SmartScreen can check its reputation before opening it.
A new, unsigned program with no established reputation is likely to receive a warning, even if an endpoint product has not flagged it. That distinction is central to the issue: avoiding one security product does not mean an attacker has defeated every layer.
Attackd tested a ZIP that already carried MotW and found that files extracted with 7-Zip 24.09 had no Zone.Identifier stream. As a result, SmartScreen was not invoked when the extracted file was started through Explorer.
The behavior resembles earlier archive-related MotW weaknesses, including the issue behind SmokeLoader 7-Zip zero-day attacks, but this finding concerns a default configuration rather than a newly assigned CVE.
Windows 11’s built-in Explorer extraction now propagates MotW from password-protected ZIP files, according to the testing.
7-Zip, however, includes a “Propagate Zone.Id stream” setting that defaults to “No” in the tested version. Setting it to “Yes,” or the available Office-files option where appropriate, enables the metadata to follow extracted content.
Why the Delivery Chain Matters
The research shows why phishing tests and defensive reviews must mirror real user behavior. A payload copied directly onto a test system may have no MotW and therefore never trigger SmartScreen, creating a misleading result.
Browser download, archive extraction, Explorer launch, PowerShell execution, and files from network shares can all pass through different safeguards.
Researchers also found that browser downloads, including files triggered with blob or data URLs, still received the Internet-zone mark in Chrome, Edge, Brave, and Firefox testing.
Edge can make an earlier reputation decision during download, while other browsers rely on their own download protections and Windows checks at launch. This matters when assessing SmartScreen vulnerability exploitation campaigns.
For defenders, the practical response is to review 7-Zip deployments and turn on Zone.Id propagation where business workflows allow it.
Security teams should validate the setting across managed endpoints, test representative archive and browser paths, retain endpoint monitoring, and teach staff not to treat an absent warning as proof that a file is safe.
Organizations should also keep archive tools current and avoid opening unsolicited compressed files. Recent reporting on new 7-Zip code flaws shows that archive handling can create separate risks beyond MotW propagation.
SmartScreen is valuable, but it is only effective when Windows receives the download-origin signal that tells it to act.
Building Resilience Against Phishing & Malware and Analyze it in a safe environment – Power your SOC with ANY.RUN
The post 7-Zip Mark-of-the-Web Bypass Lets Malicious Files Evade Windows SmartScreen appeared first on Cyber Security News.
