Zombie ZIP Technique Bypasses Security Tools

Timeline

1. 10.03.2026 22:05 1 articles · 15h ago

   Zombie ZIP Technique Bypasses Security Tools

   A new technique called 'Zombie ZIP' allows malware to evade detection by security tools by manipulating ZIP file headers. The method tricks security solutions into scanning compressed data as uncompressed, hiding the payload. The technique works against 50 out of 51 antivirus engines on VirusTotal. A proof-of-concept (PoC) has been published, and CERT/CC has issued a bulletin warning about the risks. The issue is similar to a vulnerability disclosed in 2004. The technique involves setting the ZIP Method field to STORED (Method=0), causing security tools to scan the data as raw uncompressed bytes. However, the data is actually DEFLATE compressed, making the scanner see compressed noise and miss malware signatures. A custom loader can ignore the header and decompress the data correctly. CERT/CC recommends that security tool vendors validate compression method fields, detect inconsistencies in archive structure, and implement more aggressive archive inspection modes. Users are advised to be cautious with archive files, especially from unknown sources.

   Show sources

   • New 'Zombie ZIP' technique lets malware slip past security tools — www.bleepingcomputer.com — 10.03.2026 22:05

   Open in new tab

Information Snippets

• The 'Zombie ZIP' technique manipulates ZIP headers to bypass security tools.

  First reported: 10.03.2026 22:05
  1 source, 1 article
  Show sources

  • New 'Zombie ZIP' technique lets malware slip past security tools — www.bleepingcomputer.com — 10.03.2026 22:05

• The technique works by setting the ZIP Method field to STORED (Method=0), tricking security tools into scanning compressed data as uncompressed.

  First reported: 10.03.2026 22:05
  1 source, 1 article
  Show sources

  • New 'Zombie ZIP' technique lets malware slip past security tools — www.bleepingcomputer.com — 10.03.2026 22:05

• The technique is effective against 50 out of 51 antivirus engines on VirusTotal.

  First reported: 10.03.2026 22:05
  1 source, 1 article
  Show sources

  • New 'Zombie ZIP' technique lets malware slip past security tools — www.bleepingcomputer.com — 10.03.2026 22:05

• A proof-of-concept (PoC) has been published on GitHub by researcher Chris Aziz.

  First reported: 10.03.2026 22:05
  1 source, 1 article
  Show sources

  • New 'Zombie ZIP' technique lets malware slip past security tools — www.bleepingcomputer.com — 10.03.2026 22:05

• CERT/CC has issued a bulletin warning about the risks posed by malformed archive files.

  First reported: 10.03.2026 22:05
  1 source, 1 article
  Show sources

  • New 'Zombie ZIP' technique lets malware slip past security tools — www.bleepingcomputer.com — 10.03.2026 22:05

• The issue is similar to a vulnerability disclosed in 2004, CVE-2004-0935, affecting an early version of ESET antivirus.

  First reported: 10.03.2026 22:05
  1 source, 1 article
  Show sources

  • New 'Zombie ZIP' technique lets malware slip past security tools — www.bleepingcomputer.com — 10.03.2026 22:05

• CERT/CC recommends validating compression method fields, detecting inconsistencies in archive structure, and implementing more aggressive archive inspection modes.

  First reported: 10.03.2026 22:05
  1 source, 1 article
  Show sources

  • New 'Zombie ZIP' technique lets malware slip past security tools — www.bleepingcomputer.com — 10.03.2026 22:05

• Users are advised to be cautious with archive files, especially from unknown sources.

  First reported: 10.03.2026 22:05
  1 source, 1 article
  Show sources

  • New 'Zombie ZIP' technique lets malware slip past security tools — www.bleepingcomputer.com — 10.03.2026 22:05