NewApp Digest
search bot

ZIP Files

Zombie ZIP vulnerability lets compressed malware leisurely stroll past 95% of antivirus apps — security suites are blissfully unaware of security issue
Tech Optimizer
March 13, 2026

Zombie ZIP vulnerability lets compressed malware leisurely stroll past 95% of antivirus apps — security suites are blissfully unaware of security issue

The Zombie ZIP exploit is a vulnerability that allows malware to bypass most antivirus solutions by misleading them about the nature of ZIP file contents. It takes advantage of the ZIP file structure, presenting itself as uncompressed data while hiding compressed information. This vulnerability can be easily implemented in Python with minimal code. The Computer Emergency Response Team (CERT) has issued advisory VU#976247, and the vulnerability is listed as CVE-2026-0866. Systems administrators are advised to be vigilant regarding ZIP files on their networks.
Attackers Use Malformed ZIP Archives to Evade Antivirus and EDR Tools
Tech Optimizer
March 11, 2026

Attackers Use Malformed ZIP Archives to Evade Antivirus and EDR Tools

Cybersecurity researchers at the CERT Coordination Center (CERT/CC) have identified a new evasion technique, VU#976247, used by threat actors to exploit malformed ZIP archives and bypass Antivirus (AV) and Endpoint Detection and Response (EDR) systems. Attackers manipulate the internal headers of ZIP files, particularly altering the compression method field, which causes security tools to fail in analyzing the malicious payload. While some security products may flag the modified files as corrupted, they often do not detect the underlying malicious code. Standard extraction tools typically trust the tampered metadata and may return errors, leaving the hidden payload undisclosed. Attackers use custom malware loaders to extract and execute the malicious data, circumventing traditional AV detection. Cisco has been confirmed as affected, while other vendors, including AhnLab, Avast, Bitdefender, and Avira, have an “Unknown” status regarding their vulnerability. To mitigate this threat, organizations should enhance archive handling processes, avoid relying solely on declared metadata, adopt aggressive detection modes, flag metadata inconsistencies, and consult with AV and EDR providers about vulnerabilities.
Malformed ZIP Files Allows Attackers to Bypass Antivirus and EDR Detections
Tech Optimizer
March 11, 2026

Malformed ZIP Files Allows Attackers to Bypass Antivirus and EDR Detections

A vulnerability identified as CVE-2026-0866 allows malicious actors to exploit malformed ZIP headers to bypass antivirus and Endpoint Detection and Response (EDR) systems. This flaw occurs because most security solutions rely on metadata within ZIP archives to scan and process files. When the compression method field is altered, security scanners may fail to decompress the archive correctly, resulting in a false negative and leaving the malicious payload undetected. Attackers can then use a custom loader to access the embedded malicious data, circumventing standard extraction tools. Cisco has been confirmed as affected by this vulnerability, while nearly 30 other security vendors have not disclosed their status. The cybersecurity community is urged to evolve scanning methodologies, including not relying solely on declared metadata and implementing aggressive detection modes. Organizations should verify their antivirus and EDR solutions for vulnerability to CVE-2026-0866 and monitor for custom loaders.
I tried QuickLook for Windows, and now I won't give it up
Winsage
January 31, 2026

I tried QuickLook for Windows, and now I won’t give it up

The author transitioned from Windows to Mac and discovered macOS features like Spotlight Search, Hot Corners, a built-in file converter, and QuickLook, which enhanced their user experience. Upon returning to Windows, they sought alternatives and found the QuickLook app, which allows users to preview files by selecting them and pressing the space bar. QuickLook can be downloaded from the Microsoft Store and operates system-wide, enabling previews of various file types, including documents, images, media files, and compressed ZIP files. The app also allows basic modifications, such as editing text in Word documents and cropping images. QuickLook improves file browsing in Windows File Explorer and Open/Save dialog boxes and supports plugins for specialized file types.
5 Windows apps to install first on a new PC and what each one does for you
Winsage
November 21, 2025

5 Windows apps to install first on a new PC and what each one does for you

Every new Windows laptop presents a pristine interface, but users often encounter frustrations such as locating files, cumbersome multitasking, and needing assistance with certain formats. A curated selection of applications can streamline the user experience significantly. 1) Microsoft PowerToys enhances multitasking with features like FancyZones for window arrangement, batch renaming files, resizing images, and customizing keyboard shortcuts. 2) Everything by Voidtools simplifies the search process on Windows, allowing users to find files instantly with just a few letters typed. 3) 7 Zip manages zipped folders and unconventional formats, offering features for compressing, splitting files, and securing documents with passwords. 4) Bitwarden centralizes passwords and notes, providing a single sign-in and autofill feature that syncs across devices, helping users avoid weak password reuse. 5) SumatraPDF is a lightweight PDF reader that opens documents quickly and supports epub and mobi files, serving as a basic eBook reader. These applications alleviate daily annoyances on Windows and prioritize functionality over aesthetics.
EVALUSION Campaign Using ClickFix Technique to deploy Amatera Stealer and NetSupport RAT
Tech Optimizer
November 17, 2025

EVALUSION Campaign Using ClickFix Technique to deploy Amatera Stealer and NetSupport RAT

In November 2025, a sophisticated malware campaign emerged, combining social engineering with advanced data theft tools. The attack begins with a tactic called ClickFix, where users are tricked into executing commands in the Windows Run window, leading to the installation of Amatera Stealer, which extracts sensitive information from browsers, cryptocurrency wallets, and password managers. Following this, attackers deploy NetSupport RAT for remote access to the compromised computer. Amatera Stealer employs advanced evasion techniques, including obfuscated PowerShell code and XOR encryption to mislead security efforts. It was originally marketed as ACR Stealer by a group named SheldIO. The infection process starts with a .NET-based downloader that retrieves payloads encrypted with RC2 from platforms like MediaFire. This downloader is packed with Agile.net, complicating analysis for cybersecurity teams. The malware disables AMSI by overwriting the "AmsiScanBuffer" string in memory, neutralizing Windows' security scanning. Amatera communicates with command servers through encrypted channels, using AES-256-CBC for traffic encryption, making inspection difficult. It aggregates stolen data into zip files and sends them to criminal servers, selectively executing additional payloads targeting high-value assets.
New ClickFix Attack Targeting Windows and macOS Users to Deploy Infostealer Malware
Tech Optimizer
November 13, 2025

New ClickFix Attack Targeting Windows and macOS Users to Deploy Infostealer Malware

Security researchers have identified a malware campaign using the ClickFix social engineering technique to spread information-stealing malware on Windows and macOS. The campaign targets users searching for cracked software, leading them to malicious Google-hosted landing pages. Victims encounter fake security warnings that prompt them to execute a malicious command, resulting in the installation of infostealer malware. Windows users receive the ACR stealer, while macOS users get the Odyssey stealer, both delivered in password-protected ZIP files. ACR also loads additional malware like SharkClipper, which hijacks cryptocurrency clipboard data. The campaign has seen a 700% increase in ACR logs in May 2025, with ClickFix becoming the most common initial access method, accounting for 47% of all initial access schemes. The malware collects various user data, including passwords and cryptocurrency wallets, and operates in a fileless manner to evade detection. Security experts advise against executing unverified commands and recommend enhancing endpoint detection capabilities to combat these threats.
If emulating classic DOS games seems like a pain, there's a DOSBox fork 'aiming for simplicity and ease of use', now standalone for the first time
AppWizard
October 19, 2025

If emulating classic DOS games seems like a pain, there’s a DOSBox fork ‘aiming for simplicity and ease of use’, now standalone for the first time

DOSBox Pure is a standalone application derived from the core of RetroArch, designed to simplify the process of running classic DOS games on modern systems. It allows users to load ZIP files, mounted CD and floppy disk images, and DOS executables. Available as a pay-what-you-want download on itch.io, it features a user-friendly interface and provides step-by-step instructions for launching games. Users must supply their own game files, which can be sourced from platforms like GOG. Key features include rebindable keys, gamepad and joystick support, save states, a CRT video filter, and touchpad mode. The application automatically assigns controller buttons when detecting the game and gamepad, with customization options available.
Readers still love this legendary Files by Google alternative, but why?
AppWizard
September 15, 2025

Readers still love this legendary Files by Google alternative, but why?

Total Commander is a file management application that was launched in 2012 and has a loyal following on Android. It features a straightforward user interface focused on functionality, allowing efficient navigation and direct access to the Android/data folder. The app includes smart shortcuts for quick selection, a home screen that showcases frequently accessed directories, and a plugin system for expanding capabilities with services like Google Drive and FTP. It has a built-in audio and video player with an equalizer, supports various file types, and handles ZIP files like folders. However, it lacks a multi-tab interface, breadcrumb navigation, app locking options, dedicated cleanup tools, and advanced search filters. The app has not been updated in over 17 months, raising concerns about its future viability. Despite its strengths, the reviewer prefers alternatives like Mixplorer and Samsung My Files due to the absence of modern features and an outdated interface.
Search