Security News > 2022 > November > New attacks use Windows security bypass zero-day to drop malware
![New attacks use Windows security bypass zero-day to drop malware](/static/build/img/news/new-attacks-use-windows-security-bypass-zero-day-to-drop-malware-medium.jpg)
This Mark of the Web is an alternate data stream that contains information about the file, such as the URL security zone the file originates from, its referrer, and its download URL. When a user attempts to open a file with a MoTW attribute, Windows will display a security warning asking if they are sure they wish to open the file.
After analyzing the files, Will Dormann, a senior vulnerability analyst at ANALYGENCE, discovered that the threat actors were using a new Windows zero-day vulnerability that prevented Mark of the Web security warnings from being displayed.
ISO images were being used to distribute the malware as Windows was not correctly propagating the Mark of the Web to files within them, allowing the contained files to bypass Windows security warnings.
As part of the Microsoft November 2022 Patch Tuesday, security updates were released that fixed this bug, causing the MoTW flag to propagate to all files inside an opened ISO image, fixing this security bypass.
In a new QBot phishing campaign discovered by security researcher ProxyLife, the threat actors have switched to the Windows Mark of the Web zero-day vulnerability by distributing JS files signed with malformed signatures.
As the JS file originates from the Internet, launching it in Windows would display a Mark of the Web security warning.
News URL
Related news
- Windows MSHTML zero-day used in malware attacks for over a year (source)
- Void Banshee APT exploited “lingering Windows relic” in zero-day attacks (source)
- Bad apps bypass Windows security alerts for six years using newly unveiled trick (source)
- “Perfect” Windows downgrade attack turns fixed vulnerabilities into zero-days (source)
- New Windows SmartScreen bypass exploited as zero-day since March (source)
- Critical Windows licensing bugs, plus two others under attack, top Patch Tuesday (source)
- ViperSoftX Malware Disguises as eBooks on Torrents to Spread Stealthy Attacks (source)
- PHP Vulnerability Exploited to Spread Malware and Launch DDoS Attacks (source)
- Japanese space agency spotted zero-day attacks while cleaning up raid on M365 (source)
- Facebook ads for Windows desktop themes push info-stealing malware (source)