Do Son A vulnerability dubbed "LNK Stomping" (CVE-2024-38217) is actively used to strip the 'Mark of the Web' from LNK files, bypassing Windows security policies.
MotW
A researcher reveals an unpatched Windows LNK flaw that allows UNC-based remote execution and NTLM hash capture. Microsoft declined to issue a fix.
A WinZip vulnerability (CVE-2025-33028) allows attackers to bypass Mark-of-the-Web (MotW) protection, enabling silent code execution via malicious archives.