Mark of the Web (MotW) is Windows metadata that labels a file as coming from the internet or another untrusted source. Windows uses this origin signal to decide when to apply extra caution, such as warning the user through SmartScreen or other attachment-handling checks before the file is opened.
MotW matters because many attacks depend on a user launching a downloaded document, script, or executable. If an archive extractor, email client, or file transfer workflow removes the marker, the unpacked file may look local and trigger fewer warnings. Defenders should verify that their tools preserve MotW end to end, especially when handling ZIP, 7z, or other archived downloads. In practice, MotW is a small metadata field with a big security role: it helps Windows keep untrusted files at arm’s length until they are explicitly trusted.