Zombie zip malware evades security scans, exploiting file handling flaws

A new malware technique dubbed “Zombie ZIP” is exploiting vulnerabilities in how security software processes compressed files, allowing malicious code to slip past defenses. Researchers have demonstrated the technique’s effectiveness, with only one out of 51 antivirus programs detecting the threat.

Zombie zip: a stealthy new malware tactic

The attack leverages a subtle manipulation of file metadata. Instead of compressing the malicious payload within a ZIP archive, attackers trick antivirus engines into identifying the file as uncompressed data. This causes the security software to scan for plain text or code, ultimately missing the hidden malware.

Chris Aziz, a security researcher at Bombadil Systems, uncovered this method and rigorously tested it against a broad range of antivirus solutions. The results highlighted a concerning trend: many programs rely too heavily on file extensions and compression type rather than inspecting the actual file content.

The sophistication of Zombie ZIP lies in its use of a specific loader that extracts the malware once the antivirus has deemed the file harmless. This bypass circumvents the typical error messages users might encounter when attempting to open the compromised ZIP file with standard archiving tools like WinRAR or 7-Zip. The fake error often leads users to discard the file, unknowingly allowing the malware to remain undetected.

This isn't a novel vulnerability. The underlying issue stems from a long-standing flaw in how antivirus engines handle file structures, a problem identified over 20 years ago. The CERT/CC has issued an advisory (CVE-2026-0866) highlighting the continued exploitation of this weakness.

The solution, according to CERT, requires a fundamental shift in how security tools operate. They advocate for a move away from trusting file labels and towards a deeper analysis of the file's internal composition. Aziz has released a proof-of-concept on GitHub, inviting security professionals to test their systems' resilience.

The implications are significant. Zombie ZIP represents a concerning evolution in malware tactics, showcasing how attackers can exploit fundamental weaknesses in security infrastructure. The ease with which this technique can be deployed underscores the need for a more robust and holistic approach to cybersecurity. The fact that so many antivirus programs failed to detect it suggests a widespread vulnerability that could be leveraged by malicious actors for years to come.