A new Windows zero-day allows threat actors to use malicious JavaScript files to bypass Mark-of-the-Web security warnings. Threat actors are already seen using the zero-day bug in ransomware attacks.

In previous campaign, the threat actor used MSI and EXE files. For the recent on, it switched to JavaScript files that had the following names: SYSTEM.Critical.Upgrade.Win10.0.ba45bd8ee89b1.js ...

Unlike previous SVG-based threats that relied on hosted payloads or third-party file sharing, this campaign runs entirely within the client’s browser. By avoiding executable drops and leveraging ...