Flexible Structure of Zip Archives Exploited to Hide Malware Undetected

Perception Point researchers observed phishing emails delivering concatenated ZIP files that conceal a variant of the SmokeLoader trojan; the technique abuses how different archive readers (7-Zip, Windows Explorer, WinRAR) parse concatenated archives to hide malicious payloads from some analysis tools. The report details the attack flow (malicious attachment masquerading as a shipping document), the parsing differences that enable evasion, and recommends recursive extraction and advanced detection to reveal hidden payloads.