Zombie ZIP method can fool antivirus during the first scan

Zombie ZIP is a ZIP file manipulation technique that sets the compression method to 'stored' while the contained data is actually DEFLATE-compressed, causing many antivirus products to treat the bytes as uncompressed noise and miss malware signatures during the first scan; the method requires a custom loader to recover the payload, limiting practical exploitation, and researchers debate whether it merits a CVE (CVE-2026-0866).