Guys, ever downloaded a file, only to realize you just invited a cybercriminal for a coffee. Well, be ready to thank CVE-2025–0411, 7zip made sure cybercriminals didn’t even have to knock.😂

CVE-2025–0411 is a vulnerability in 7zip that allows the attacker to bypass the security feature in windows. Nothing but the Mark-of-the-web security feature which is responsible for identifying the files downloaded from the internet is safe or not.

Here is the deal, when you download a file from the internet, windows usually adds a MoTW tag to the file to warn you. So that malware could not execute on your system.

How does this affect me?

Here is the problem that occurs, when you extract a MoTW tagged file the extracted file loses its MoTW tag. Meaning, windows will no longer consider them as unsafe, and the files will get executed without triggering any security warning.

This attack was targeted on Ukranian organizations using phising emails and malicious zip files. Does that mean others are safe? Of course not.

What to do?

Here is what you should do to avoid potential exploitation,

• Update 7Zip to the latest version. Which will be 24.09.
• Try to be cautious while extracting files, even from trusted websites.

Thanks to the Trend zero Day Initiative (ZDI) who is a Threat hunting team who discovered this. After they reported this, the creators of 7Zip launched a patch in version 28.4. Which I have asked to update into🤗🫡.

Have any suggestions, please don’t hesitate to reach out🤘. Always ready to improve✍️.