Archive Extraction

Ask most security teams how they handle incoming ZIP files and you’ll hear the same answer: “We scan them.” What they mean is that their anti-malware or EDR solution reads the archive’s header, extracts the contents, and scans for known threats. The problem is that most scanning engines trust what an archive declares about itself. Attackers have known how to exploit that assumption for years.