Loading story…
Elastic Security Labs identified multiple ways attackers can bypass or erode the reputation-based protections in Windows Smart App Control (SAC) and Microsoft Defender SmartScreen. The methods include using fraudulently obtained code-signing certificates, hijacking trusted application reputation, seeding files to build favorable reputation, and modifying binaries without apparently losing SAC reputation. Researchers also reported an LNK stomping flaw in which a specially structured shortcut causes explorer.exe to rewrite the file and remove its Mark of the Web before SmartScreen evaluates it; VirusTotal samples indicated the technique may already have been used in the wild.
SmartScreen evaluates the reputation of URLs, files, applications, and digital certificates, and uses blocklists and behavioral analysis to warn users about phishing, malware, unsafe downloads, deceptive advertising, and potentially unwanted applications. However, organizations should not treat those warnings as a standalone control: SmartScreen does not protect files originating from internal locations or network shares, and reputation can be abused. Defenders should monitor anomalous execution from download directories, abuse of script hosts, and explorer.exe overwriting .lnk files, while managing SmartScreen policies through Group Policy or Microsoft Intune.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
The researchers reported the LNK stomping issue to the Microsoft Security Response Center. They stated that Microsoft might address it in a future Windows update.
Specially crafted LNK files caused explorer.exe to rewrite shortcuts into canonical form and remove their Mark of the Web before SmartScreen checks. The researchers used the technique to launch PowerShell and execute Calculator under Smart App Control, and chained it with the cdb debugger to run shellcode.
Researchers demonstrated that code-signing abuse, reputation hijacking of trusted script hosts, reputation seeding, and binary modification could circumvent reputation-based protections. They also showed trusted Lua, Node.js, AutoHotkey, and JamPlus components being used to execute code without expected warnings.
Researchers identified multiple VirusTotal samples exhibiting the LNK overwrite behavior used to remove Mark of the Web metadata; the oldest identified sample had been submitted more than six years earlier.
Microsoft introduced Smart App Control as a cloud-reputation-based Windows 11 protection that blocks malicious or untrusted applications; when enabled, it replaces Defender SmartScreen.
Microsoft built Defender SmartScreen into Windows beginning with Windows 8, using reputation checks and Mark of the Web-triggered assessments for downloaded files.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has disclosed a sustained series of **security feature bypass** vulnerabilities across Windows and related components, with multiple advisories tied to **Mark of the Web (MotW)**, **SmartScreen**, **MapUrlToZone**, Windows shortcut handling, and security zone mapping. The most detailed recent case, `CVE-2026-32225`, affects **Windows Shell** and allows attackers to bypass SmartScreen protections that rely on MotW by persuading a user to open a specially crafted `.lnk` file. Microsoft said successful exploitation could cause Windows to launch commands or Control Panel applets without proper MotW handling, potentially enabling arbitrary command execution or the loading of attacker-controlled DLLs; the flaw was rated **Important**, assigned a **CVSS 8.8**, marked as **more likely to be exploited**, and fixed at disclosure. The newer Windows Shell issue follows a broader pattern of Microsoft fixes for related bypasses, including `CVE-2022-44698` in **Windows SmartScreen**; `CVE-2023-36564` in **Windows Search**; `CVE-2023-36584`, `CVE-2024-38217`, and `CVE-2024-43487` in **Windows Mark of the Web**; `CVE-2024-30073` in **Windows Security Zone Mapping**; `CVE-2025-21328`, `CVE-2025-21329`, and `CVE-2025-21332` in **MapUrlToZone**; and `CVE-2025-47160` in **Windows Shortcut Files**. Additional bypass advisories affected Microsoft products including **Publisher**, **Office Developer Platform**, **PowerShell**, **Kerberos**, **Windows Hello**, **Surface**, and **PC Manager**, underscoring Microsoft's continued effort to close gaps in trust labeling and execution safeguards that attackers can abuse to reduce warnings and increase the success of social-engineering attacks.
Jun 29, 2026
Microsoft published advisories for multiple **security feature bypass** vulnerabilities affecting Windows and Office components, including `CVE-2023-36025` in **Windows SmartScreen**, `CVE-2023-36413` in **Microsoft Office**, `CVE-2023-21715` in **Microsoft Publisher**, and `CVE-2026-21514` in **Microsoft Word**. The flaws were categorized as bypass issues rather than direct remote code execution bugs, indicating attackers could evade built-in protections intended to warn users or restrict unsafe content. The disclosures show a recurring pattern across Microsoft products in which trust and warning mechanisms can be circumvented, potentially increasing the success of phishing, malicious document delivery, and other social-engineering attacks. Organizations relying on SmartScreen and Office security controls should review the relevant Microsoft Security Update Guide entries for affected products and ensure patches are applied to reduce the risk of users opening files or content that bypass normal safeguards.
Jul 12, 2026
Multiple reports describe ways attackers or testers can **abuse trusted enterprise features** to evade controls. Researchers reported that *Palo Alto Networks Cortex XDR* **Live Terminal** can be repurposed as a stealthy **command-and-control (C2)** channel because its WebSocket-based protocol lacks command signing; an attacker who can intercept the initial WebSocket message can redirect an endpoint to an attacker-controlled server/tenant, leveraging the trusted `cortex-xdr-payload.exe` component to execute commands in a “living off the land” manner. Separately, a tutorial showed *Microsoft Defender for Cloud Apps* (reverse-proxy `*.mcas.ms`) download restrictions for unmanaged devices can be **bypassed by spoofing specific browser user-agent strings**, allowing direct access to services like Outlook/SharePoint and enabling successful downloads that would otherwise be blocked. Other material in the set covers adjacent but distinct execution and delivery risks rather than the same product-specific bypasses. **CVE-2026-27615** affects *ADB-Explorer* on Windows: allowing `ManualAdbPath` to be set to a **UNC path** in a settings file can lead to **remote code execution** by pointing the app to an attacker-controlled network share, fixed in Beta `0.9.26022`. Cofense also documented ongoing campaigns abusing **Windows File Explorer WebDAV** handling to deliver malware without a browser download flow, including use of `trycloudflare[.]com` tunnels to host WebDAV servers and multi-stage script chains to deliver RATs—highlighting a persistent social-engineering and delivery vector that can bypass some browser-centric controls.
Jun 29, 2026