The “Zombie ZIP” technique is a newly discovered evasion method that exploits how security tools parse ZIP file headers to hide malicious payloads. 

How it Works

• Header Manipulation: Attackers modify the “Compression Method” field in the ZIP header to 0 (Stored/Uncompressed).
• Deceptive Content: Even though the header claims the data is uncompressed, the actual payload is compressed using the standard DEFLATE algorithm.
• Scanning Bypass: Security tools (Antivirus, EDR) trust the header and scan the file as raw, uncompressed bytes.
• Invisible Noise: Because the data is actually compressed, the scanner only sees “noise” and fails to find any malware signatures.
• Successful Execution: A purpose-built malicious loader can ignore the false header, decompress the “Zombie” data, and execute the hidden payload. 

Scope and Impact

• High Success Rate: Research by Chris Aziz of Bombadil Systems found this technique worked against 50 out of 51 antivirus engines tested on VirusTotal.
• Vulnerability Tracking: The issue has been assigned identifier CVE-2026-0866.
• Archive Tool Failure: Standard utilities like WinRAR or 7-Zip may report the files as corrupted or throw “unsupported method” errors when attempting to open them. 

Prevention and Mitigation

• For Vendors: Security products must be updated to validate compression method fields against the actual data and detect structural inconsistencies in archives.
• For Users: Treat any archive that triggers an “unsupported method” error with extreme suspicion and delete it immediately.
• Caution: Avoid opening ZIP files from unknown or untrusted sources, even if they appear to be standard documents.