A weaponized archive is a compressed file, such as a ZIP or RAR, that has been prepared to help deliver malicious content. The archive may hide an executable, a script, a shortcut, or a document with embedded code, often using filenames and icons that look routine. The goal is to get a user to open or extract it, starting the infection chain.
Weaponized archives matter because they exploit normal file-handling behavior rather than a software vulnerability. In real attacks, they are commonly used in phishing and malware delivery to bypass casual inspection and to make malicious files easier to transfer through email or cloud storage. Defenders look for suspicious archive contents, double extensions, password-protected attachments, and mismatches between the displayed file type and the actual file behavior. Sandboxing, attachment detonation, and user training all help reduce risk, especially when archives are used to launch loaders, dropper malware, or follow-on payloads.