What Is Mark of the Web (MOTW)? How It Stops Malicious Files

Mark of the Web, usually shortened to MOTW, is a small tag Windows attaches to files that arrive from the internet — a browser download, an email attachment, a file pulled from a network share outside your intranet. That tag tells Windows and apps like Microsoft Office and File Explorer to treat the file as untrusted, which triggers warnings, blocks active content such as macros, and routes the file through Microsoft Defender SmartScreen before it can run freely. It matters because MOTW is one of the last checkpoints standing between a malicious attachment and your desktop, and it's exactly the checkpoint that attackers have spent the last several years trying to sneak past — most recently with CVE-2026-96951, a Windows Shell flaw Microsoft patched this month after confirming it was already being exploited.

What is Mark of the Web, exactly?

Mark of the Web isn't a popup or a visible label. It's metadata Windows stores directly on the file itself, on any volume formatted with NTFS. According to Microsoft's own documentation on Mark of the Web and zones, when a file is downloaded to a device running Windows, Windows adds Mark of the Web to the file, identifying it as coming from an untrusted source such as the internet or the Restricted Sites security zone. The mechanism is an NTFS alternate data stream — a second, hidden stream of data attached to the file, separate from its visible contents — named Zone.Identifier. You can see it yourself on almost any file you've downloaded by opening a command prompt and running notepad {filename}:Zone.Identifier, which opens a small text file with a [ZoneTransfer] section and a ZoneId value.

Because it lives in an alternate data stream rather than the file's main content, MOTW is invisible in normal use. You won't see it in a file's properties at a glance, and copying the file's bytes somewhere else — without copying the stream — silently drops the tag. That quirk, more than any single bug, is the root cause of most Mark of the Web bypass techniques, including the one behind CVE-2026-96951.

How Windows decides a file is "from the internet"

MOTW is a byproduct of Windows' older Internet Explorer-era security zones, which are still very much alive under the hood. Every location Windows touches is mapped to one of five zones, each identified by a ZoneId value stored inside that Zone.Identifier stream:

In plain terms: by default, Windows only writes Mark of the Web onto files that came from the open internet or from sites explicitly flagged as restricted. A file saved from an intranet site, a "Trusted sites" entry, or your own machine never gets tagged at all, which is why organizations sometimes add internal file servers to the Trusted sites or Local intranet zone on purpose — doing so quietly removes the friction MOTW would otherwise add.

What actually happens when a file carries the tag

Mark of the Web by itself doesn't block anything. It's a signal that other Windows and Office components check before deciding how much to trust a file. Based on Microsoft's documentation, three things commonly happen:

• Office blocks macros and shows a Security Risk banner. A macro-enabled Word, Excel or PowerPoint file with Mark of the Web opens with VBA macros disabled, and current Office builds display a banner with no "Enable content" option — the user has to deliberately unblock the file first.
• Protected View opens the file read-only. Office documents with MOTW, or from an unsafe location, open in a sandboxed, read-only view until the user chooses to enable editing.
• Microsoft Defender SmartScreen checks executables and installers. Per Microsoft's SmartScreen overview, downloaded apps and installers are checked against lists of known-malicious software and against a reputation list of frequently downloaded, well-known files; anything unfamiliar triggers a warning screen before it can run.

Files saved to a designated Trusted Location on the device skip all of this — Office treats them as safe outright, which is one more reason Microsoft recommends using Trusted Locations sparingly.

Which files MOTW actually covers

MOTW isn't limited to Office documents, but how visibly it acts depends heavily on the file type and the app opening it.

That last row is the important one for security purposes: container formats that wrap other files — ZIP archives, ISO disc images, virtual hard disks — have repeatedly been the easiest way to lose the Mark of the Web along the way, because not every unpacking or mounting tool bothers to copy the Zone.Identifier stream onto what comes out.

Why attackers specifically go after Mark of the Web

MOTW rarely stops a determined, skilled attacker from running arbitrary code eventually — what it stops is the easy path. Without it, a phishing email with a macro-enabled spreadsheet opens straight to an "Enable Content" prompt instead of a harder-to-dismiss Security Risk banner; a downloaded installer skips the SmartScreen reputation check; an Office exploit chain that depends on a user opening a document gets one less speed bump in its way. For ransomware and commodity malware operators sending the same lure to thousands of targets, removing one layer of friction meaningfully raises the number of people who click through.

That's why "Mark of the Web bypass" has become its own small category of Windows vulnerability, tracked separately from the malware that exploits it. When Microsoft or NVD use the phrase "security feature bypass" in a CVE title, it specifically means the flaw doesn't hand an attacker code execution on its own — it removes or defeats a defensive layer like MOTW so that some other technique works more easily.

A short history of Mark of the Web bypass vulnerabilities

CVE-2026-96951 isn't the first time Microsoft has had to patch a way around MOTW, and it probably won't be the last. Here are three confirmed cases, drawn from NVD and CISA's own records:

The pattern across all three: none of them break Windows' cryptography or authentication. Each one simply finds a path — a file format quirk, a shell handler, a command-injection flaw — that lets a file reach the user's desktop without the Zone.Identifier stream intact, or lets Windows Shell mishandle a file in a way that skips the checks MOTW is supposed to trigger.

Inside CVE-2026-96951, this month's MOTW bypass

Microsoft's October 2026 Patch Tuesday — covered in detail in our full rundown of that update cycle — fixed CVE-2026-96951, officially titled the Windows Shell Security Feature Bypass Vulnerability. It lives in Windows Shell, the component behind File Explorer and the shell-integrated handlers that decide how a file behaves when it's opened. NVD classifies the underlying weakness as CWE-77, improper neutralization of special elements used in a command, commonly called command injection.

The practical effect, per Microsoft's advisory, is that a specially crafted file can bypass Mark of the Web protections, skipping the Protected View and SmartScreen warnings that would normally fire. Exploitation requires a user to interact with the file — Microsoft's own FAQ for the advisory notes an attacker can't force a user to view attacker-controlled content, so this isn't a zero-click flaw. It is, however, a flaw Microsoft confirmed was being actively exploited before a patch existed, which is why CISA added it to its Known Exploited Vulnerabilities catalog on October 13, 2026, with a remediation deadline of October 16 for federal civilian agencies — a deadline that has already passed as of publication.

NVD lists the base CVSS 3.1 score at 8.8 (High), under the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; a temporal score of 8.2 has also circulated, and a 9.8 figure seen in some secondary reporting doesn't match either Microsoft's or NVD's published scoring. Fixes shipped for Windows 10 22H2, Windows 11 24H2/25H2/26H2, and Windows Server 2019/2022/2025, alongside a server-side update to Outlook.com. Several older, out-of-mainstream-support builds are listed by some trackers as affected without a corresponding fixed build, which is worth flagging clearly: if you're still running one of those older versions, treat MOTW as compromised on that machine until you can confirm otherwise with Microsoft's advisory directly.

How to check — and safely remove — Mark of the Web yourself

There are two supported ways to see whether a file is tagged, and two to remove the tag when you're confident the file is safe:

• Check via Properties. Right-click the file, choose Properties, and look at the General tab. If Windows added MOTW, you'll see a security note and an "Unblock" checkbox.
• Check via command line. Run notepad {filename}:Zone.Identifier in a command prompt to view the raw ZoneId value, or inspect it with the Unblock-File PowerShell cmdlet's companion, Get-Item -Stream Zone.Identifier.
• Remove it via Properties. Tick the "Unblock" checkbox on the General tab and click OK. This deletes the Zone.Identifier stream.
• Remove it via PowerShell. The Unblock-File cmdlet does the same thing at the command line and is the only practical option for unblocking files in bulk.

Unblocking a file is a legitimate, routine action — IT admins do it constantly for trusted internal tools, templates and scripts. The risk is doing it on autopilot. Removing Mark of the Web from a file you haven't verified is functionally the same thing an attacker's bypass technique is trying to achieve: it switches off the warnings before anyone looks closely at what's inside.

How to actually protect yourself

MOTW is a useful layer, not a complete defense, and Microsoft's own guidance treats it that way. A sensible baseline looks like this:

• Install Windows updates promptly, especially anything CISA flags in its Known Exploited Vulnerabilities catalog — MOTW-bypass flaws are routinely weaponized within days of disclosure.
• Don't casually click "Unblock" on attachments or downloads you can't verify, even if a file "looks" like a normal document or archive.
• Keep Microsoft Defender SmartScreen and Protected View enabled; they're the components that actually act on the MOTW signal, and disabling them removes the benefit even on a fully patched system.
• Treat MOTW as one layer in a broader model rather than a silver bullet — the same logic behind approaches like zero trust security, which assumes no single signal, including a file tag, should be trusted on its own.
• For organizations, enable the "Block macros from running in Office files from the Internet" policy rather than relying on end users to recognize warning banners.

What to do next

If you manage your own PC, confirm Windows Update has installed the October 2026 cumulative update and leave Microsoft Defender SmartScreen turned on. If you manage a fleet of machines, prioritize endpoints that regularly receive attachments and external links first, and don't assume older, out-of-support Windows builds are covered just because newer ones received a fix. Mark of the Web will keep doing quiet, mostly invisible work in the background — but as CVE-2026-96951 shows, it's only as strong as the Windows Shell code that's supposed to honor it, and that code gets probed by attackers every time Microsoft ships a patch for it.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage