{"id":222985,"date":"2026-03-10T16:05:00","date_gmt":"2026-03-10T20:05:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/03\/10\/new-zombie-zip-technique-lets-malware-slip-past-security-tools\/"},"modified":"2026-03-12T21:20:12","modified_gmt":"2026-03-13T01:20:12","slug":"new-zombie-zip-technique-lets-malware-slip-past-security-tools","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/03\/10\/new-zombie-zip-technique-lets-malware-slip-past-security-tools\/","title":{"rendered":"New ‘Zombie ZIP’ technique lets malware slip past security tools"},"content":{"rendered":"

New ‘Zombie ZIP’ technique lets malware slip past security tools<\/a><\/p>\n

https:\/\/www.bleepingcomputer.com\/news\/security\/new-zombie-zip-technique-lets-malware-slip-past-security-tools\/<\/a><\/p>\n

Publish Date: 2026-03-10 16:05:00<\/a><\/p>\n

Source Domain: www.bleepingcomputer.com<\/a><\/p>\n

\n

Update: Article updated with comments from security researchers who believe this should not be considered a vulnerability.<\/p>\n

A new technique dubbed \u201cZombie ZIP\u201d helps conceal payloads in compressed\u00a0files specially created to avoid detection from security solutions such as antivirus and endpoint detection and response (EDR) products.<\/p>\n

Trying to extract the files with standard utilities\u00a0like WinRAR or\u00a07-Zip results in errors or corrupted data.\u00a0The technique\u00a0works by manipulating ZIP headers to trick parsing engines into treating compressed data as uncompressed.<\/p>\n

Instead of flagging the archive as potentially dangerous, security tools trust the header and scan the file as if it were\u00a0a copy of the original in a ZIP container.<\/p>\n

The \u201cZombie ZIP\u201d technique was devised by Bombadil Systems security researcher Chris Aziz, who found that it works against 50 of the 51 AV engines on VirusTotal.<\/p>\n

“AV engines trust the ZIP Method field. When Method=0 (STORED), they scan the data as raw uncompressed bytes. But the data is actually DEFLATE compressed –\u00a0so the scanner sees compressed noise and finds no signatures,” the researcher\u00a0explains.<\/p>\n

A threat actor can create a loader that ignores the header and treats the archive for what it is: data compressed using the standard Deflate algorithm used in modern ZIP files.<\/p>\n

The researcher has published a proof-of-concept (PoC) on GitHub, sharing sample archives and additional details on how the method works.<\/p>\n

To cause popular extraction tools (e.g., 7-Zip, unzip, WinRAR) to generate an error, the researcher says that the CRC value that ensures data integrity has to be set to the\u00a0uncompressed payload’s checksum.<\/p>\n

\u201cHowever, a purpose-built loader that ignores the declared method and decompresses as DEFLATE recovers the payload perfectly,\u201d\u00a0Aziz says.<\/p>\n

Yesterday, the CERT Coordination Center (CERT\/CC) published a bulletin to warn about \u201cZombie ZIP\u201d and raise awareness of the risks posed by malformed archive…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

New ‘Zombie ZIP’ technique lets malware slip past security tools https:\/\/www.bleepingcomputer.com\/news\/security\/new-zombie-zip-technique-lets-malware-slip-past-security-tools\/ Publish Date: 2026-03-10 16:05:00…<\/p>\n","protected":false},"author":1,"featured_media":222986,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.bleepstatic.com\/content\/hl-images\/2026\/03\/10\/zombiezip.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[32,34,27],"class_list":["post-222985","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-malware","tag-threat-actor","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/222985"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=222985"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/222985\/revisions"}],"predecessor-version":[{"id":222987,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/222985\/revisions\/222987"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/222986"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=222985"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=222985"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=222985"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}