The 0patch micropatching service has released an unofficial security patch to mitigate a zero-day vulnerability in the Microsoft Windows Mark-of-the-Web (MotW) security mechanism that is being actively exploited in-the-wild. MotW is a security feature that labels suspicious files and webpages, forcing them to run in the security zone of the location the page was saved from. Security zones are a collection of systems that require the same access control policy, and act as invisible boundaries that prevent certain web applications from performing unauthorized actions with a browser. MotW labels tell the operating system, web browsers, and other applications that the file could be malicious, triggering a warning to the user informing them that opening the file or webpage could be dangerous. This flaw was first identified in July 2022 by Will Dormann, a senior vulnerability researcher at ANALYGENCE, who noticed that MotW flags were not being added to suspicious ZIP files. If exploited, this vulnerability could allow a threat actor to deliver maliciously-crafted files within a ZIP archive that when extracted, would not have the embedded malicious macros marked by MotW flags, allowing for the successful download of malware on the vulnerable device. At this time there is currently no official patch from Microsoft, however 0patch has developed free patches that will defend Windows users in the meantime. If customers already have an 0patch account, the patch will download automatically. Otherwise, the patch can be installed after registering an account with 0patch and downloading the 0patch agent. CTIX analysts will continue to monitor activity surrounding this MotW vulnerability, and an update piece may be published in a future FLASH Update.