{"id":161043,"date":"2026-02-14T17:12:01","date_gmt":"2026-02-14T15:12:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-7-zip-26-00-vredonosnyj-sajt-7zip-com-stilizovannyj-pod-7-zip-org"},"modified":"2026-02-14T17:12:01","modified_gmt":"2026-02-14T15:12:02","slug":"vypusk-7-zip-26-00-vredonosnyj-sajt-7zip-com-stilizovannyj-pod-7-zip-org","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-7-zip-26-00-vredonosnyj-sajt-7zip-com-stilizovannyj-pod-7-zip-org","title":{"rendered":"Release 7-Zip 26.00. Malicious site 7zip.com styled to look like 7-zip.org","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Igor Pavlov has released a new version of the archiver 7-Zip 26.00. The project continues to develop its own archive format 7z, based on LZMA and LZMA2 compression algorithms. Additionally, it supports packing and unpacking archives in the formats XZ, BZIP2, GZIP, TAR, ZIP, and WIM, as well as unpacking over 30 archive formats, packages, virtual machine images, and file systems (ISO, NTFS, EXT*, UDF, UEFI, VDI, VHD, VMDK, CAB, RPM, SquashFS, QCOW2, etc.). For ZIP and GZIP formats, a 2-10% higher compression level is achieved compared to PKZip and WinZip. The project code is written in C++ and is distributed under the LGPL license. Ready-to-use builds for Windows, macOS, and Linux (i686, x86-64, ARM, ARM64) are available for download. <\/p>\n
The new version improves the code for supporting ZIP, CPIO, RAR, UFD, QCOW, and Compound formats. In 7-Zip File Manager, the sorting order of the file list has been improved (the file name is now used as a secondary key during sorting). The performance testing toolkit has been expanded to support systems with more than 64 CPU threads. TAR archive extraction, containing files with gaps, has been streamlined. <\/p>\n
After the release, users noticed that the default antivirus package in Windows flagged the installer file as malicious. This behavior turned out to be a false positive, and Microsoft published an antivirus database update within the day, after which Windows Defender stopped issuing alerts (you can install the Windows Defender database update by running the command Update-MpSignature).
<\/center> <\/p>\n
In addition, it has been reported that attackers created the website 7zip.com, which mimicked the official site of the project 7-zip.org, but offered a modified installer 7zipInstall.exe for download that contained malicious code. The modified installer was signed with a certificate issued by Jozeal Network Technology. When searching for the keyword 7zip, the site 7zip.com appeared in 4th place in Google search results with the title \"Secure and Fast Download for Windows \u2014 Get 7-Zip\". The site was also promoted through YouTube videos with installation instructions for 7-zip. <\/p>\n
The attached malware installed components in the user's system that allowed the computer to be used as a proxy for covering tracks during attacks, bypassing restrictions, organizing the download of malware, and sending discovered credentials of infected malware. The malicious installer was provided for the Windows platform and, upon launch, placed components in the directory \"C:\\Windows\\SysWOW64\\hero\\\", set up autostart for included files uphero.exe (update loader) and hero.exe (proxy), and also added firewall rules for allowing the specified executable files to initiate and receive network connections by launching the netsh utility. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Release](\"\/wp-content\/uploads\/2026\/02\/56a3fa5f1df2aecd519a1fec682735d2.png\")
<\/center> <\/p>\n