A newly documented technique called Zombie ZIP allows malware to hide inside a deliberately malformed archive file, bypassing nearly every major antivirus and endpoint detection tool on the market. Security researcher Chris Aziz of Bombadil Systems discovered the technique and tested it against 51 antivirus engines on VirusTotal. It bypassed 50 of them. The CERT Coordination Center has since issued an official advisory and assigned the vulnerability the identifier CVE-2026-0866.
Most people treat a ZIP file that refuses to open as a minor inconvenience. Attackers are now treating that reaction as cover.
How ZIP Files Are Structured
To understand Zombie ZIP, you need to know a little about how ZIP archives work. Every ZIP file contains two things: the compressed data itself, and a set of metadata headers that describe that data. One of the most critical fields in those headers is the compression method. This field tells both extraction tools and security scanners how the data inside was packaged.
The most common method is called DEFLATE. When a scanner sees DEFLATE in the header, it decompresses the data before analyzing it. When the method field says 0, which is known as STORED, the scanner reads the raw bytes directly, treating them as plain uncompressed data.
Zombie ZIP exploits this behavior. The archive declares Method=0 in its header, but the actual contents are DEFLATE-compressed. The scanner follows the header’s instruction and reads the raw compressed bytes as if they were plain text. What it sees is scrambled, unreadable data with no recognizable malware signatures. So it clears the file as safe.
The payload sits untouched inside, waiting.
Why Standard Tools Can’t Open These Files
This is where Zombie ZIP becomes unusual. Common extraction tools like WinRAR and 7-Zip are actually stricter than most security scanners. They cross-check the declared compression method against the file’s actual structure. When the two don’t match, they refuse to extract the file and return errors, such as CRC failures or “unsupported method” warnings.
So a file that passes an antivirus scan is also a file that ordinary tools cannot open. That combination is both the technique’s main limitation and its built-in alibi. A user who receives a ZIP file that won’t open will likely assume it is corrupted and delete it. Few people would suspect the file was engineered to behave that way.
Not a Standalone Exploit
Zombie ZIP is not a remote code execution vulnerability. It is a delivery and evasion mechanism. For it to deploy malware, an attacker also needs a custom loader on the target machine, one specifically built to read malformed archives and decompress the hidden contents. Standard tools will not do this.
That requirement limits how Zombie ZIP can be used. But it does not make the technique unimportant. Evading detection is one of the hardest problems attackers face. A method that clears 50 of 51 antivirus engines is genuinely useful, even when it requires additional setup to complete an attack.
It is also worth noting that a proof of concept is now public. Once that happens, techniques like this tend to show up in real-world campaigns before most defenders have adapted.
A Problem the Industry Has Seen Before
CERT/CC notes that Zombie ZIP closely resembles a vulnerability from over two decades ago. CVE-2004-0935 affected an early version of an ESET antivirus product and involved the same core flaw: security tools placing too much trust in archive metadata without validating it against actual file contents.
The fact that a structurally similar issue has resurfaced in 2026 says something about how the industry handles archive inspection. The problem was known. It was not fully solved.
Zombie ZIP is also not the only recent example of this approach. Earlier in 2026, researchers documented Gootloader, a malware loader tied to ransomware operations, using deliberately malformed ZIP archives to evade forensic tools. The specific techniques differ, but the core strategy is the same: craft an archive that defenders cannot read, while ensuring attackers can.
What CERT/CC Recommends
CERT/CC’s advisory is aimed at both security vendors and everyday users.
For vendors, the recommendations focus on improving archive scanning. Security tools should validate the declared compression method against the actual data structure. They should also detect inconsistencies between ZIP headers and file contents, and apply deeper inspection to archives that behave unexpectedly.
For users, the guidance is more straightforward. Any archive file that returns an “unsupported method” error deserves suspicion, especially if it arrived unexpectedly or from an unknown sender. Do not attempt to repair it using third-party utilities from unfamiliar sources. Those tools could themselves serve as the custom loaders needed to execute whatever is hidden inside. If you cannot explain why you received the file, deleting it is the right call.
A Reminder About What Antivirus Can and Cannot Do
Antivirus software catches a lot. However, Zombie ZIP is a clear example of the gaps that still exist, even in well-maintained security products. It does not require nation-state resources or sophisticated infrastructure. One researcher built and documented it. Now it is public.
The practical takeaway is simple. A ZIP file that will not open is not always just a corrupted download. If it arrived out of nowhere, came from someone you do not know, or appeared in an unexpected email attachment, treat it with caution. The file being unreadable is not proof that it is harmless. In the case of Zombie ZIP, being unreadable is the point.
