A new Windows zero-day allows threat actors to use malicious JavaScript files to bypass Mark-of-the-Web security warnings. Threat actors are already seen using the zero-day bug in ransomware attacks.

A new stealthy JavaScript malware loader named RATDispenser is being used to infect devices with a variety of remote access trojans (RATs) in phishing attacks.

The real vulnerability is not JavaScript/JScript, its Windows Script Host. We can disable WSH, but this comes with a small risk — there may be software that uses it on any given Windows machine.