New ‘Zombie ZIP’ technique lets malware slip past security tools
New ‘Zombie ZIP’ technique lets malware slip past security tools
Publish Date: 2026-03-10 16:05:00
Source Domain: www.bleepingcomputer.com
Update: Article updated with comments from security researchers who believe this should not be considered a vulnerability.
A new technique dubbed “Zombie ZIP” helps conceal payloads in compressed files specially created to avoid detection from security solutions such as antivirus and endpoint detection and response (EDR) products.
Trying to extract the files with standard utilities like WinRAR or 7-Zip results in errors or corrupted data. The technique works by manipulating ZIP headers to trick parsing engines into treating compressed data as uncompressed.
Instead of flagging the archive as potentially dangerous, security tools trust the header and scan the file as if it were a copy of the original in a ZIP container.
The “Zombie ZIP” technique was devised by Bombadil Systems security researcher Chris Aziz, who found that it works against 50 of the 51 AV engines on VirusTotal.
“AV engines trust the ZIP Method field. When Method=0 (STORED), they scan the data as raw uncompressed bytes. But the data is actually DEFLATE compressed – so the scanner sees compressed noise and finds no signatures,” the researcher explains.
A threat actor can create a loader that ignores the header and treats the archive for what it is: data compressed using the standard Deflate algorithm used in modern ZIP files.
The researcher has published a proof-of-concept (PoC) on GitHub, sharing sample archives and additional details on how the method works.
To cause popular extraction tools (e.g., 7-Zip, unzip, WinRAR) to generate an error, the researcher says that the CRC value that ensures data integrity has to be set to the uncompressed payload’s checksum.
“However, a purpose-built loader that ignores the declared method and decompresses as DEFLATE recovers the payload perfectly,” Aziz says.
Yesterday, the CERT Coordination Center (CERT/CC) published a bulletin to warn about “Zombie ZIP” and raise awareness of the risks posed by malformed archive…
