Attackers Use Malformed ZIP Archives to Evade Antivirus and EDR Tools

**Executive summary:** CERT/CC issues an advisory on VU#976247 describing a ZIP archive header manipulation evasion that causes AV/EDR scanners to rely on incorrect compression metadata and miss embedded malicious payloads; attackers circumvent this by using custom loaders that ignore the tampered fields to extract and execute hidden malware. Cisco is confirmed affected and organizations are advised to stop trusting declared archive metadata, enable aggressive detection modes, flag metadata inconsistencies, and contact vendors for patches.