A recent disclosure describes a technique known as “Zombie ZIP”, which allows attackers to manipulate ZIP archive metadata in a way that misleads security tools. By altering specific header values, the archive appears to contain uncompressed data, while the actual content remains compressed.
Because many antivirus engines rely on header information rather than verifying the real structure of the file, this trick can allow malicious content to slip through initial scans undetected.
Early testing showed that approximately 95% of tested antivirus solutions (60 out of 63) did not flag malicious payloads hidden using this method.
However, the technique has practical limitations that reduce its real-world exploitation risk.
Technical Overview
How the Technique Works
The Zombie ZIP method involves modifying the ZIP file header—specifically the compression method field.
- A value of 0 (STORED) indicates that files are not compressed.
- Security tools interpret this value and assume the file content is directly readable.
In reality:
- The payload is still compressed using DEFLATE
- Antivirus engines scan the data as if it were uncompressed
- This results in scanning meaningless compressed data (“noise”) instead of the real payload
CRC Manipulation
The attacker also modifies the CRC (checksum) value:
- The checksum corresponds to the uncompressed data
- This creates inconsistency between:
- Declared compression method
- Actual stored data
This mismatch causes:
- Standard tools (e.g., Windows extractor, 7-Zip, WinRAR) to flag errors
- Corrupted or failed extraction attempts
Attack Mechanism
Evasion Strategy
The evasion works due to a trust issue:
- Antivirus engines rely on metadata instead of validating actual compression
- When the method is set to STORED:
- Engines skip decompression
- Payload remains hidden
Payload Recovery
A custom-built loader is required to:
- Ignore the declared compression type
- Force DEFLATE decompression
- Extract the original malicious payload successfully
Detection and Limitations
Key Limitation
This technique cannot execute on its own.
- A specially crafted loader is required
- Standard archive tools will not properly open the file
- Users are likely to see errors or corrupted output
This significantly reduces the likelihood of widespread exploitation.
Detection Capabilities
- Once the payload is correctly decompressed:
- Known malware can still be detected by security solutions
- The bypass only affects:
- Initial static inspection
- It does NOT bypass:
- Behavioral detection
- Runtime protection
- Signature detection after extraction
Notably, Malwarebytes / ThreatDown successfully detected both:
- The malformed archive
- The extracted payload
Vulnerability Classification Debate
The issue has been assigned:
- CVE-2026-0866
However, there is disagreement in the security community:
- Some researchers argue:
- This is not a traditional vulnerability
- It is more of a design limitation or evasion technique
- Reason:
- Requires user interaction or prior compromise
- Cannot independently infect systems
Indicators and Analysis Techniques
Identifying Suspicious ZIP Files
One reliable detection method involves comparing size fields:
- Compressed Size
- Uncompressed Size
- If these values differ while the method is marked as STORED, it indicates inconsistency.
This suggests:
- The file is actually compressed
- The header has been tampered with
Safe Analysis Approach
Security researchers recommend:
- Using controlled tools that:
- Ignore header values
- Attempt forced decompression
- Avoid relying solely on standard extraction utilities
Risk Assessment
| Factor | Assessment |
|---|---|
| Exploit Complexity | Moderate |
| User Interaction Required | Yes |
| Dependency on Custom Loader | High |
| Detection Bypass Scope | Limited to initial scan |
| Real-World Impact | Low to Moderate |
Mitigation Recommendations
For Security Teams
- Do not rely solely on ZIP metadata during inspection
- Implement deeper archive validation logic
- Flag inconsistencies between header fields and actual data
For SOC Analysts
- Treat malformed ZIP files as suspicious
- Perform manual or sandbox-based extraction
- Inspect archive structure rather than trusting headers
For Vendors
- Update scanning engines to:
- Verify compression methods
- Attempt fallback decompression when inconsistencies are found
The Zombie ZIP technique highlights a subtle but important weakness in how security tools process archived files. By exploiting trust in metadata, attackers can briefly evade detection during the scanning phase.
Despite its high initial bypass rate, the method is constrained by its reliance on a custom loader and its inability to evade detection after proper extraction.
In practical terms, this is less of a critical vulnerability and more of a reminder that security tools must validate data, not just trust declared formats.
