Don’t Click on That: Infected Zip Files are Invading Email Again

Photo by enzezo / Shutterstock.com

You’re busy, so I’ll say this fast and loud: DON’T OPEN UNEXPECTED ZIP FILES THAT ARRIVE AS EMAIL ATTACHMENTS. Suddenly, there are a lot of them around.

That advice is nearly as old as email, but as they say, everything old is new again. And the internet is newly awash in spam sending out booby-trapped zip file attachments. My inbox has seen a steady trickle of the stuff for the past couple of months, but I didn’t think much of it until I chatted with Sophos Chief Technology Officer Joe Levy this week. Zip archives that contain malicious JavaScript files are on the rise, he said.

Users who fall for the trick and decompress a zip attachment by clicking on it don’t see an executable file — but rather a .js file or similar — and run the code. The two-step technique is obviously working for criminals.

Sophos data show a dramatic rise in zip-javascript spam. In fact, it shows zip files with poisonous javascript have pretty much completely replaced Office attachments (infected Word documents or spreadsheets) as the attack technique preferred by spammers. So if you’ve received spam recently, you’ve probably received an infected zip attachment.

The emails arrive in typical fashion. One promised me a “confirmation letter.” A more clever version offered a travel expense sheet. The most believable says “voice message from outside caller.”

Why is it back?

Well-configured spam and security software should protect organizations from this attack. So why are spammers suddenly adopting the technique again?

“As long as your organization’s network is administered correctly, there’s no real chance of infection. Which begs a question. Why do we still see this malspam [malicious spam] every day?” writes SANS on an analysis of the attack. “The answer? We assume enough people get infected, so sending .js malspam is profitable for the criminals behind this operation. Why else would we still see it?”

Akin to the IRS scam, which just keeps working and working, infected zip attachments are popping up all over because they work.

You can see a lot more examples of the spam at that SANS link, but here’s the other essentials from their analysis:

  • This malspam appears to target Windows computers.
  • The extracted file is Javascript-based, and the infection requires user action.
  • The user must open the zip attachment, extract the .js file, and manually run the .js file.
  • A properly administered Windows host using software restriction policies should prevent an infection.

Again, zip attachments are hardly new. And even this particular version of attack isn’t that new — the SANS analysis was from last year.

But here’s an important lesson about digital security I learned from Bruce Schneier many years ago. Attacks move in awareness cycles. There’s a new attack (Click on this attachment!) that works. Bad guys copycat it. It works on a large scale. Then consumers become painfully aware of it, learn their lesson, and stop clicking. The technique becomes exhausted, and bad guys move on. People forget about it and let their guard down. Then, a bad guy rediscovers the attack, tries it, and it works. And the cycle begins again.

That’s where we are with zip files, it would seem.

So if you would never fall for the zip file attack, good for you. I promise you know someone who will. So now is the time to offer a gentle reminder: Nothing good ever comes from unexpected zip files.

More from Bob Sullivan:

How to find cheaper car insurance in minutes

Getting a better deal on car insurance doesn't have to be hard. You can have The Zebra, an insurance comparison site compare quotes in just a few minutes and find you the best rates. Consumers save an average of $368 per year, according to the site, so if you're ready to secure your new rate, get started now.

Read Next
How Much of My Social Security Benefit Can My Ex Take From Me?
How Much of My Social Security Benefit Can My Ex Take From Me?

A man wonders if his ex-wife will siphon away his Social Security benefit.

Could You Give Up These 7 Expenses to Save Thousands of Dollars a Year?
Could You Give Up These 7 Expenses to Save Thousands of Dollars a Year?

These monthly costs eat at your disposable income. Here’s what you’d save if you cut them entirely or even trim them just 10%.

9 Houseplants That Remove Toxins From Your Indoor Air
9 Houseplants That Remove Toxins From Your Indoor Air

These plants may also do everything from reduce the amount of dust in your home to improve your productivity.

16 Amazon Purchases That We Are Loving Right Now
16 Amazon Purchases That We Are Loving Right Now

These practical products make everyday life a little easier.

26 Work-From-Home Jobs That Pay $100,000
26 Work-From-Home Jobs That Pay $100,000

These lucrative gigs let you work in your slippers.

View this page without ads

Help us produce more money-saving articles and videos by subscribing to a membership.

Get Started

Most Popular
Will I Get My Ex-Husband’s Social Security When He Dies?
Will I Get My Ex-Husband’s Social Security When He Dies?

Two factors determine how much money is coming to you.

7 Ways to Boost Your Credit Score Fast
7 Ways to Boost Your Credit Score Fast

Your financial security might soon depend upon the strength of your credit score.

22 Things You Should Always Buy at a Dollar Store
22 Things You Should Always Buy at a Dollar Store

The dollar store has great bargains on these purchases.

5 Household Disinfectants That Can Destroy the Coronavirus
5 Household Disinfectants That Can Destroy the Coronavirus

You likely already have some of these products at home.

6 Reasons I Will Never Trust Suze Orman
6 Reasons I Will Never Trust Suze Orman

Beware: The self-proclaimed personal finance expert has a track record that suggests more sizzle than steak.

20 Things That Are Actually Worth Stockpiling
20 Things That Are Actually Worth Stockpiling

You probably don’t need a year’s supply of toilet paper to survive an outbreak, but consider stocking up on these items.

America’s Most Reliable Appliance Brand Is a Surprise
America’s Most Reliable Appliance Brand Is a Surprise

Have you heard of this appliance manufacturer?

This Type of Social Security Benefit Is Often Overlooked
This Type of Social Security Benefit Is Often Overlooked

The Social Security Administration is not helping certain people get money to which they are entitled, a report says.

Getting These 2 Shots Could Reduce Your Risk of Dementia
Getting These 2 Shots Could Reduce Your Risk of Dementia

These vaccines may lower the risk of Alzheimer’s disease by up to 40%.

9 Everyday Problems You Can Solve With Vaseline
9 Everyday Problems You Can Solve With Vaseline

Forget expensive specialty products. Good ol’ petroleum jelly can address many common annoyances.

10 Deep Discounts Available on Amazon This Friday
10 Deep Discounts Available on Amazon This Friday

These items are all steeply discounted — but the deals won’t last long.

19 Purchases That Buyers Almost Always Regret
19 Purchases That Buyers Almost Always Regret

Think twice before buying these things.

19 High-Paying Jobs You Can Get With a 2-Year Degree
19 High-Paying Jobs You Can Get With a 2-Year Degree

These jobs pay more than the typical job in the U.S. — and no bachelor’s degree is required.

7 Tips for Building an Emergency Stockpile
7 Tips for Building an Emergency Stockpile

A pandemic or natural disaster could leave you reliant on your existing food supply. Is your pantry prepared?

8 of the Worst Things to Buy at a Dollar Store
8 of the Worst Things to Buy at a Dollar Store

Not everything sold at dollar stores is a great bargain or a safe purchase. Here’s our list of products to avoid.

41 Things You Should Never Buy
41 Things You Should Never Buy

Some purchases are just plain dumb. Give yourself — and your budget — a break. Don’t spend money on this stuff.

5 Ways to Get Amazon Prime for Free
5 Ways to Get Amazon Prime for Free

Hesitant to drop $119 a year on an Amazon Prime membership? Here’s how to get it for free.

13 Brilliant Bulk-Buy Items on Amazon
13 Brilliant Bulk-Buy Items on Amazon

Every household should have these products on hand. Buying them in bulk on Amazon saves you cash.

8 Award-Winning Products That Impressed 40,000 Shoppers
8 Award-Winning Products That Impressed 40,000 Shoppers

The Product of the Year awards help shoppers find the best pet products, personal care items and everything in between.

View More Articles

View this page without ads

Help us produce more money-saving articles and videos by subscribing to a membership.

Get Started

Add a Comment

Our Policy: We welcome relevant and respectful comments in order to foster healthy and informative discussions. All other comments may be removed. Comments with links are automatically held for moderation.