ZIP Files Archives

Tech Optimizer

September 22, 2026

This fake LastPass Authenticator app will just shut off your antivirus and leave you open to attack

LastPass has identified a sophisticated scheme targeting users of its Authenticator app, involving SEO poisoning and deceptive GitHub pages that distribute malicious ZIP files disguised as legitimate software. Users searching for "LastPass Authenticator download" may encounter these counterfeit pages, which redirect them to a malicious server delivering a ZIP file containing vsdbg.exe and vsdbg.dll. The executable is a legitimate Microsoft debugging tool exploited to execute the malicious DLL through DLL sideloading, allowing the malware to run undetected. Named Rapuncel by security researchers from Delphos, this malware is undetectable by antivirus engines and targets a hardcoded list of 145 antivirus and endpoint security products, disabling them upon detection. Rapuncel harvests sensitive information, including saved passwords from over 25 web browsers, cryptocurrency wallet files from more than 30 applications, and session tokens from platforms like Discord and Steam. It also captures screenshots and compiles a profile of the infected system, uploading the stolen data to an attacker-controlled server. The malware includes a kernel driver that intercepts web traffic, allowing for advertisement injection and search result manipulation. This campaign has been active for several months, with LastPass vaults remaining unaffected. Users are advised to download applications only from trusted sources. Rapuncel establishes persistence on infected machines by installing itself as a Windows service that starts with the system and terminates activated security products. Removing the kernel driver requires booting into Safe Mode or using external recovery tools, as standard Windows utilities cannot eliminate software operating at that level.

Winsage

September 2, 2026

Fake Microsoft Edge, Kaspersky and Razer Installers Used to Compromise Windows Systems

An ongoing malware campaign is targeting Windows devices through counterfeit download pages for well-known software brands like Microsoft Edge, Kaspersky, and Razer. The campaign affects various sectors, including healthcare, manufacturing, gaming, technology, logistics, government, and education. It utilizes high-fidelity fraudulent websites that closely mimic legitimate vendors, with observed lure domains such as app-microsoft-edge[.]com[.]cn and kaspersky-lab[.]hl[.]cn. Attackers employ evasion tactics like server-side payload regeneration and create multiple copies of the same archive in quick succession. Victims are lured into downloading ZIP files that contain a bundled wrapper installer, which activates a stage-one executable in randomized directories. The malware often masquerades as legitimate software, with some payloads impersonating known applications. Persistence is achieved through scheduled tasks with unusual names, and the malware employs various evasion techniques, including deleting shadow copies and altering file permissions. Microsoft Defender has identified activity across multiple stages of the attack, including delivery, execution, and command-and-control communications. To mitigate risks, organizations are advised to block downloads from unofficial sources, enforce Tamper Protection, and implement Attack Surface Reduction rules. Indicators of compromise (IOCs) include specific lure domains and URLs associated with the campaign.

AppWizard

May 20, 2026

You can now build Android apps in minutes by describing them to Google AI Studio

Google has introduced AI-powered features in Google AI Studio to simplify Android app development. Users can describe their app ideas in plain language, and the AI translates these into functional Android applications via a web browser. The platform generates the app's framework, user interface, and core functionalities using Kotlin and Jetpack Compose, supporting features like GPS, Bluetooth, and NFC. AI Studio includes an in-browser Android Emulator for building and testing apps, along with Android Debug Bridge integration for direct deployment to devices. Currently, the tools are aimed at personal utilities and lightweight projects, with plans for broader sharing options in the future. The platform can automatically create Play Console records, package Android App Bundles, and upload builds for testing, reducing manual steps. Developers can also export projects as zip files for further work in Android Studio or GitHub. Future expansions will include support for Firebase services. Additionally, Google has introduced the "Ask Play" feature for app discovery, allowing users to search using conversational prompts instead of keywords, and plans to integrate Android applications within Gemini interactions across mobile and web platforms.

Winsage

April 24, 2026

Stop installing these 4 apps—Windows does it all now

Windows has evolved to integrate functionalities that were once reliant on third-party applications, such as native support for ZIP files introduced in Windows ME in 2000, and the ability to open and create RAR, TAR, and 7z formats directly from File Explorer. Features like Storage Sense have replaced the need for tools like CCleaner by allowing users to manage temporary files more easily, and the effectiveness of Windows Defender has reduced the necessity for third-party antivirus solutions. Additionally, modern Windows can mount ISO files directly, eliminating the need for applications like Daemon Tools. The trend of operating systems adopting features from third-party applications, known as "Sherlocking," reflects a response to user demands while still allowing for optional third-party solutions.

Winsage

April 16, 2026

Fake Proton VPN sites are pushing NWHStealer malware to Windows users

A malware campaign is utilizing counterfeit Proton VPN websites and other deceptive tactics to distribute a Windows infostealer known as NWHStealer. This malware extracts sensitive information, including browser credentials and cryptocurrency wallet details, and operates stealthily by injecting itself into legitimate processes. Two primary infection vectors have been identified: malicious ZIP archives on a free web hosting platform and trojanized installers from fake Proton VPN sites. The malware employs DLL hijacking and can exfiltrate data to a command-and-control server while ensuring persistence through scheduled tasks and disguising payloads as legitimate system processes. It also exploits the Windows cmstp.exe utility to bypass User Account Control. Users are advised to avoid downloading software from unofficial sources and to verify file signatures and publisher information.

Tech Optimizer

March 13, 2026

Zombie ZIP vulnerability lets compressed malware leisurely stroll past 95% of antivirus apps — security suites are blissfully unaware of security issue

The Zombie ZIP exploit is a vulnerability that allows malware to bypass most antivirus solutions by misleading them about the nature of ZIP file contents. It takes advantage of the ZIP file structure, presenting itself as uncompressed data while hiding compressed information. This vulnerability can be easily implemented in Python with minimal code. The Computer Emergency Response Team (CERT) has issued advisory VU#976247, and the vulnerability is listed as CVE-2026-0866. Systems administrators are advised to be vigilant regarding ZIP files on their networks.

Tech Optimizer

March 11, 2026

Attackers Use Malformed ZIP Archives to Evade Antivirus and EDR Tools

Cybersecurity researchers at the CERT Coordination Center (CERT/CC) have identified a new evasion technique, VU#976247, used by threat actors to exploit malformed ZIP archives and bypass Antivirus (AV) and Endpoint Detection and Response (EDR) systems. Attackers manipulate the internal headers of ZIP files, particularly altering the compression method field, which causes security tools to fail in analyzing the malicious payload. While some security products may flag the modified files as corrupted, they often do not detect the underlying malicious code. Standard extraction tools typically trust the tampered metadata and may return errors, leaving the hidden payload undisclosed. Attackers use custom malware loaders to extract and execute the malicious data, circumventing traditional AV detection. Cisco has been confirmed as affected, while other vendors, including AhnLab, Avast, Bitdefender, and Avira, have an “Unknown” status regarding their vulnerability. To mitigate this threat, organizations should enhance archive handling processes, avoid relying solely on declared metadata, adopt aggressive detection modes, flag metadata inconsistencies, and consult with AV and EDR providers about vulnerabilities.

Tech Optimizer

March 11, 2026

Malformed ZIP Files Allows Attackers to Bypass Antivirus and EDR Detections

A vulnerability identified as CVE-2026-0866 allows malicious actors to exploit malformed ZIP headers to bypass antivirus and Endpoint Detection and Response (EDR) systems. This flaw occurs because most security solutions rely on metadata within ZIP archives to scan and process files. When the compression method field is altered, security scanners may fail to decompress the archive correctly, resulting in a false negative and leaving the malicious payload undetected. Attackers can then use a custom loader to access the embedded malicious data, circumventing standard extraction tools. Cisco has been confirmed as affected by this vulnerability, while nearly 30 other security vendors have not disclosed their status. The cybersecurity community is urged to evolve scanning methodologies, including not relying solely on declared metadata and implementing aggressive detection modes. Organizations should verify their antivirus and EDR solutions for vulnerability to CVE-2026-0866 and monitor for custom loaders.

Winsage

January 31, 2026

I tried QuickLook for Windows, and now I won’t give it up

The author transitioned from Windows to Mac and discovered macOS features like Spotlight Search, Hot Corners, a built-in file converter, and QuickLook, which enhanced their user experience. Upon returning to Windows, they sought alternatives and found the QuickLook app, which allows users to preview files by selecting them and pressing the space bar. QuickLook can be downloaded from the Microsoft Store and operates system-wide, enabling previews of various file types, including documents, images, media files, and compressed ZIP files. The app also allows basic modifications, such as editing text in Word documents and cropping images. QuickLook improves file browsing in Windows File Explorer and Open/Save dialog boxes and supports plugins for specialized file types.

Winsage

November 21, 2025

5 Windows apps to install first on a new PC and what each one does for you

Every new Windows laptop presents a pristine interface, but users often encounter frustrations such as locating files, cumbersome multitasking, and needing assistance with certain formats. A curated selection of applications can streamline the user experience significantly. 1) Microsoft PowerToys enhances multitasking with features like FancyZones for window arrangement, batch renaming files, resizing images, and customizing keyboard shortcuts. 2) Everything by Voidtools simplifies the search process on Windows, allowing users to find files instantly with just a few letters typed. 3) 7 Zip manages zipped folders and unconventional formats, offering features for compressing, splitting files, and securing documents with passwords. 4) Bitwarden centralizes passwords and notes, providing a single sign-in and autofill feature that syncs across devices, helping users avoid weak password reuse. 5) SumatraPDF is a lightweight PDF reader that opens documents quickly and supports epub and mobi files, serving as a basic eBook reader. These applications alleviate daily annoyances on Windows and prioritize functionality over aesthetics.