Zombie ZIP method can fool antivirus during the first scan

Zombie ZIP is a ZIP-format evasion technique that manipulates ZIP header fields to mark compressed data as 'stored' (uncompressed), causing many antivirus engines to treat the payload as noise and miss malware signatures during initial inspection. The method requires a custom loader to properly decompress and recover the payload, limiting infection opportunities on uncompromised systems; the issue is tracked as CVE-2026-0866 and was detected by some vendors (e.g., Malwarebytes).