Unsupported Compression Methods Enable Android Malware to Bypass Detection

Zimperium zLab analyzed Android APKs that abuse an unsupported ZIP compression method (and additional APK corruptions such as oversized filenames and malformed AndroidManifest/string pools) to evade decompilation and static analysis; a retrohunt found ~3,300 samples using the technique and 71 malicious samples that can load on Android 9+ devices. The report details the technical mechanisms, lists package names and many file hashes as indicators of compromise, and states these apps are not found in Google Play (likely distributed via third-party stores or sideloading).