New Windows SmartScreen bypass exploited as zero-day since March

Microsoft patched a SmartScreen Mark-of-the-Web bypass (CVE-2024-38213, aka "copy2pwn") in June 2024 after Trend Micro / ZDI found it exploited in the wild to strip MotW protections from files (notably when copying from WebDAV), enabling malware delivery (DarkGate/DarkMe) by financially motivated cybercrime groups; the flaw required user interaction but was actively abused prior to the patch.