A security feature bypass exists in the handling of Internet Shortcut (.URL) files. The issue stems from a protection mechanism failure where Windows fails to correctly propagate Mark-of-the-Web (MotW) zone identifiers—a mechanism used to mark files downloaded from the internet as untrusted—when parsing these files. This allows attackers to bypass Microsoft Defender SmartScreen and other security warnings, enabling the silent delivery and execution of malware. Exploitation occurs when a user opens a specially crafted .URL file, which can be delivered via email, SharePoint, or network shares. In some cases, attackers use a double-shortcut technique where a file disguised as a `.jpeg` is actually a `.url` file that points to another shortcut to trigger the bypass. This flaw has been actively exploited in ransomware campaigns and by the APT group Water Hydra to deliver info-stealers and the DarkGate malware, often executing commands via `rundll32.exe` or `ieframe.dll`.