Archive abuse is the misuse of compressed files such as ZIP, RAR, or 7z to help malware evade inspection or change where files end up on disk. Attackers may hide payloads inside nested archives, use misleading filenames, or exploit archive features that write files outside the expected folder.
It matters because archives are common in email, downloads, and software distribution, so security tools often trust them or inspect them less deeply. In real attacks, archive abuse can deliver a script or executable, place it in a startup path, or unpack supporting files needed for later stages. Some archive bugs and path traversal issues can even let an attacker overwrite unintended locations during extraction.
Defenders look for unexpected archive nesting, dangerous file paths like ../, and archives that contain executables, scripts, or shortcut files. Sandboxing extraction and blocking automatic execution from unpacked content reduces risk.