alt.hn

2/14/2026 at 2:58:29 PM

7zip.com Is Serving Malware

 https://www.malwarebytes.com/blog/threat-intel/2026/02/fake-7-zip-downloads-are-turning-home-pcs-into-proxy-nodes

by Alifatisk

2/14/2026 at 5:07:07 PM

7zip.com has never been the official website of the project. It's been 7-zip.org

by Dwedit

2/14/2026 at 5:26:54 PM

How can the average 7zip user know which one it is?

Search results can be gamed by SEO, there were also cases of malware developers buying ads so links to the malware download show up above legitimate ones. Wikipedia works only for projects prominent enough to have a Wikipedia page.

What are the other mechanisms for finding out the official website of a software?

by pibaker

2/14/2026 at 6:12:01 PM

There is normally a wiki page for every popular program which normally contains an official site URL. That's how I remember where to actually get PuTTY. Wiki can potentially be abused if it's a lesser known software, but, in general, it's a good indicator of legitimacy.

by n4bz0r

2/14/2026 at 6:24:56 PM

So wikipedia is now part of the supply chain (informally) which means there is another set of people who will try to hijack Wikipedia, as if we didn't had enough, just great.

by throwaway198846

2/15/2026 at 2:21:47 AM

You can corroborate multiple trusted sources, especially those with histories. You can check the edit history of the Wikipedia article. Also, if you search "7zip" on HN, the second result with loads of votes and comments is 7-zip.org. Another is searching the Archlinux package repos; you can check the git history of the package build files to see where it's gotten the source from.

by jolmg

2/15/2026 at 3:53:42 AM

And we're really going to do all the brouhaha for a single dl of an alternative compressor ? And then multiple that work as a best practice for every single interaction on the Internet? No we're not.

by halJordan

2/15/2026 at 5:26:02 AM

The dl for some programs are often on some subdomain page with like 2 lines of text and 10 dl links for binaries, even for official programs. Its so hard to know whether they are legit or not.

by carshodev

2/15/2026 at 7:04:22 AM

My point was more along the lines of "there's no need to complain about Wikipedia being hijackable, there are other options", and now you're complaining about having too many options...

You don't need to do everything or anything. They're options. Use your own judgment.

by jolmg

2/14/2026 at 6:57:31 PM

I was always impressed by how fast wikipedia editors revert that kind of stuff, so I think it's great advice actually!

by lyu07282

2/14/2026 at 6:50:23 PM

What's your solution? If you search google for 7-zip the official website is the first hit.

by jamespo

2/14/2026 at 7:15:18 PM

Not exactly news, wiki's been used for misinformation quite extensively from what I recall. You can't always be 100% sure with any online source of information, but at least you know there is an extensive community that'll notice if something's fishy rather sooner than later.

by n4bz0r

2/14/2026 at 5:54:33 PM

> How can the average 7zip user know which one it is?

I dunno, if you type "download 7zip" into Google, the top result is the official website.

Also, 7zip.com is nowhere on the first page, and the most common browsers show you explicitly it's a phishing website.

This is actually a pretty good case of the regular user being pretty safe from downloading malware.

by antisthenes

2/14/2026 at 6:18:34 PM

I feel I need to clarify my earlier comment. I was asking how can a user tell, in general, what is the legitimate website of a software, not just how to know what 7zip.com is malicious.

Are the search removals and phishing warnings reactive or proactive? Because if it is the former then we don't really know how many users are already affected before security researchers got notified and took action.

Also, 7zip is not the only software to be affected by similar domain squatting "attacks." If you search for PuTTY, the unofficial putty.org website will be very high on the list (top place when I googled "download putty.") While it is not serving malware, yet, the fact that the more legitimate sounding domain is not controlled by the original author does leave the door open for future attacks.

by pibaker

2/14/2026 at 7:56:20 PM

One way is to consult the same source(s) where the user learned about the software in the first place.

by layer8

2/14/2026 at 6:11:50 PM

> I dunno, if you type "download 7zip" into Google, the top result is the official website.

Until someone puts an ad above it.

by sedatk

2/14/2026 at 7:37:43 PM

Sure, but the answer to "How can the average 7zip user know which one it is?" would then be "do a Google search and use uBlock Origin".

by 8organicbits

2/14/2026 at 8:11:24 PM

How does the user know they are using the official uBlock Origin?

by pixl97

2/14/2026 at 9:12:27 PM

The Mozilla extension store doesn't have ads, so it's the top item. It has clear download counts and a "recommended" icon.

So the advice is to install it from the extension store.

by 8organicbits

2/14/2026 at 8:27:39 PM

> Also, 7zip.com is nowhere on the first page

In incognito window, for me, it's 3rd result

by TiredOfLife

2/15/2026 at 4:55:33 AM

It's possible, although I can't replicate this result anymore.

On google search I don't see it on the first page, and the only sketchy link on page 2 is https://7zip.dev/en/download/.

Bing is worse, since it shows 7zip.com on the 2nd page, but the site refuses to load.

But I am using Thorium with manifest v2 ublock and Edge with medium setting for tracker/ad block.

by antisthenes

2/15/2026 at 1:23:08 PM

Fails to load for me with: "The page was blocked because of a matching filter in uBlock filters – Badware risks."

Which is enabled by default in uBlock. And installing it is pretty much a standard suggestion for any web user.

by Lockal

2/14/2026 at 7:03:33 PM

How would you ensure that the "average user" actually gets to the page he expects to get to?

There are risks in everything you do. If the average user doesn't know where the application he wants to download _actually_ comes from then maybe the average user shouldn't use the internet at all?

by harladsinsteden

2/15/2026 at 2:04:17 AM

> How would you ensure that the "average user" actually gets to the page he expects to get to?

I think you practically can't and that's the problem.

TLS doesn't help with figuring out which page is the real one, EV certs never really caught on and most financial incentives make such mechanisms unviable. Same for additional sources of information like Wikipedia, since that just shifts the burden of combatting misinformation on the editors there and not every project matters enought to have a page. You could use an OS with a package manager, but not all software is packaged like that and that doesn't immediately make it immune to takeovers or bad actors.

An unreasonable take would be:

> A set of government run repositories and mirrors under a new TLD which is not allowed for anything other than hosting software packages, similar to how .gov ones already owrk - be it through package manager repositories or websites. Only source can be submitted by developers, who also need their ID verified and need to sign every release, it then gets reviewed by the employees and is only published after automated checks as well. Anyone who tries funny business, goes to jail. The unfortunate side effect is that you now live in a dystopia and go to jail anyways.

A more reasonable take would be that it's not something you can solve easily.

> If the average user doesn't know where the application he wants to download _actually_ comes from then maybe the average user shouldn't use the internet at all?

People die in car crashes. We can't eliminate those altogether, but at least we can take steps towards making things better, instead of telling them that maybe they should just not drive. Tough problems regardless.

by KronisLV

2/15/2026 at 4:36:07 PM

> People die in car crashes. We can't eliminate those altogether, but at least we can take steps towards making things better, instead of telling them that maybe they should just not drive. Tough problems regardless.

I agree with the sentiment but there are limits to what we can and should do. To stay with your analogy: We don't let people drive around without taking a test. In that test they have to prove that they know the basics of how to drive a car. At least where I come from that means learning quite a bit of rules and regulations.

In other words: Don't let people off the hook. They need to do some form of learning by themselves. It's no different with what you do on the internet. If you're not willing to do some kind of work to familiarize yourself with how the bloody thing work then it's not the job of everyone else to make sure you'll be okay. It's _your_ job to understand the basics.

I'm getting tired of just another thing we must take off peoples minds so that they can "just" use whatever they want to use. Don't try to blame (or god forbid sue) someone else because you didn't do your homework.

by harladsinsteden

2/15/2026 at 8:36:54 PM

> It's _your_ job to understand the basics

I feel like this line of thinking is dangerous: people hit the wall hard when they don’t have sex ed, or financial education classes, or even basic classes on how to cook or do crafts (we had those in school, girls mostly cooked and the guys got to learn woodworking but also swapped sometimes; and later in university there were classes about work safety in general), or computer literacy classes.

I think a lot of people don’t even have basic mental models of how OSes or the Internet works, what a web browser is (“the Google”) and so on.

Saying that they should know that stuff won’t change the fact that they don’t unless you teach them as a part of their overall education.

by KronisLV

2/14/2026 at 6:49:17 PM

Open source software will have a code repo with active development happening on it. That repo will usually link to official Web page and download places.

by imglorp

2/15/2026 at 8:18:34 AM

The fork with malware embedded could fairly easily apply most commits to the main repo in its public repo.

They could even have support pages that look real, by copying them from the legitimate site.

And the process of creating a repo that stays in sync with another fork can be automated, so, if needed, malware writers likely will do that.

by Someone

2/14/2026 at 7:46:31 PM

Not universal true. Open source just means that the code is avaiable, not that developement happens in the open. (But 7zip does have a github repo)

by lukan

2/14/2026 at 6:20:48 PM

1. Go to the wikipedia article on 7-Zip

2. Go the listed homepage

by rtcode_io

2/15/2026 at 3:48:13 AM

Avoid downloading stuff of internet and avoid search engines.

In a post AI world asking how not be scammed is hard cause now everything can be faked.

Trust what you definitely know but still verify.

Especially in the next 5-10 years that's going to become the reality so I guess sit tight and prepare for the waves and sunamis of scams.

by cermicelli

2/14/2026 at 6:43:11 PM

open About in the app?

by Markoff

2/14/2026 at 5:50:52 PM

I tested with the 3 major browsers and all 3 block it as "Suspected Phishing". So looks like the system is working as designed.

Lookalike websites serving malware have always existed. So this isn't exactly news. But the browsers are blocking them like they should.

by throwaway150

2/14/2026 at 7:05:33 PM

Weirdly, in Firefox 7zip.com is blocked but www.7zip.com isn't. If you type '7zip' in the address bar and then press Ctrl+Enter to go to the address, you'll get owned, because that key-combo adds the www at the beginning.

by chalion

2/15/2026 at 3:38:43 AM

Yes, and I think this case gets somewhat more notoriety because the phishing site has the .com domain and the legitimate one has a .org.

Like it or not, .com adds perceived trustworthiness and works as a branding signal, especially in these times of VCs throwing large amounts of money at branding and buying 3 to 6 letter .com domains, but a small project like 7zip cannot afford that kind of expense.

by pentagrama

2/14/2026 at 7:04:58 PM

The links to the file downloads on 7zip.com all point to 7-zip.org. Example: https://www.7-zip.org/a/7z2501-x64.exe

Did they change it because of the negative publicity (Reddit) and will probably change back soon to the malware links?

by krypd0h

2/14/2026 at 7:10:44 PM

Maybe that's how they don't get banned by their hosting provider. Once reports start coming in, they pretend to be a honest establishment.

by chalion

2/15/2026 at 9:45:03 AM

As a Linux user, used to get all of my software either through the distro's repository or Flathub, having to download software from sites when I run Windows makes me feel really queasy.

by ruicraveiro

2/15/2026 at 10:18:43 AM

winget ftw

by FireInsight

2/14/2026 at 5:06:52 PM

Does the 7-Zip author still refuse to digitally sign or even provide hashes of the official downloads? It's an extremely weird flex, he thinks it's a frivolous waste of time or something.

by tokyobreakfast

2/14/2026 at 5:19:05 PM

He's always been an odd one, for a long time he refused to enable even basic hardening features like ASLR and DEP because they made the executables slightly larger. He eventually relented on some of those, but last I heard the more advanced mitigations like HE-ASLR, CFG and GS were still disabled.

by jsheard

2/15/2026 at 1:04:07 AM

Even more, there are regularly security vulnerabilities patched in releases that don't get CVEs and don't get any mention in patch notes, there are no incremental commits between releases, just giant code dumps. There's no changelog linked on the 7-zip.org website. There's no auto-update or update check mechanism, which is problematic for a project with regular CVEs whose primary purpose is handling untrusted inputs.

7-zip is not a serious project and its use should be strongly discourged.

by mirashii

2/14/2026 at 5:34:17 PM

I migrated from 7-Zip to NanaZip, a fork with modern Windows features that the original developer refuses to implement.

https://github.com/M2Team/NanaZip

by reddalo

2/14/2026 at 5:50:01 PM

Whenever I see "modern Windows experience", it always turns to be worse than the original one.

by baal80spam

2/14/2026 at 7:46:05 PM

I take your point, and usually you're right, but in this case "modern features" includes things like having an "extract" button show up when you right click an archive file in Explorer.

by margalabargala

2/14/2026 at 10:36:54 PM

You can have that, and in an even better way: Simply disable the blight that is Windows 11 context menus and go back to real context menus.

I’m not even joking, they are basically superior in every way. They open faster, they have only one visual axis and they support all the shell extensions you remember. (Too many shell extensions could make them just as slow though.)

by fuzzy2

2/15/2026 at 8:39:38 PM

OK, I had no idea Windows 11 doesn't have it. I am on Windows 10, and then it's Linux/MacOS for me.

by baal80spam

2/14/2026 at 6:04:07 PM

I would agree normally, but this one is a nice change and upgrade, actually.

by deltastone

2/14/2026 at 7:36:39 PM

Well yeah, it says "modern" not "better".

Modern Windows and OS X and Android and iOS are all worse than the old ones.

by dlcarrier

2/14/2026 at 8:28:49 PM

Windows 11 has 7-zip support built in.

by TiredOfLife

2/14/2026 at 7:13:35 PM

No update for a year for something that opens weird files from the internet is a little scary, even just dependency changes. Not that 7-zip was ever any better at that.

by Already__Taken

2/14/2026 at 6:27:39 PM

modern windows features?

I imagine an electron rewrite, with DirectX 12 and Copilot buttons everywhere

by blibble

2/15/2026 at 9:50:38 PM

Yes, but in this case no. The modern features are dark mode, and an "Extract" function in the right-click menu of Windows 11.

by reddalo

2/14/2026 at 5:09:39 PM

Do people even double check installers are digitally signed? There's so much open source stuff out there that is not digitally signed, most people might not even notice.

by giancarlostoro

2/14/2026 at 5:13:57 PM

Windows has displayed a big scary orange prompt for at least the last decade when it isn't. More like 15-20 years IIRC.

But I'm sure people blindly click through the "Unknown author" prompt just as they would ignore a certificate error.

by tokyobreakfast

2/14/2026 at 5:16:14 PM

Like I said, theres a LOT of open source projects that show that prompt. Signing an MSI involves having a valid CA certificate, which AFAIK is not free, and goes beyond the budget of most projects.

by giancarlostoro

2/14/2026 at 5:21:32 PM

It's not free but it's not expensive either. Most well known Windows open source projects have them; e.g. PuTTY, Wireguard, VLC, Rufus, etc.

Maybe it's high time for a free-as-in-beer CA for non-profit open source developers funded by donations?

Edit: I was wrong.

Prices on code signing certificates have skyrocketed to in excess of $500/year, due in part to continuing meddling by the CA/B forum which increased the requirements of standard certs to be the same as EV certs, and requiring the key to be stored in a hardware token—which must now be re-issued yearly.

This makes it near impossible to provide free or affordable certificates to developers. Thanks CA/B forum, lots of help as usual.

by tokyobreakfast

2/14/2026 at 8:25:50 PM

We're up for renewal with PortableApps.com. The same one year non-EV code signing certificate with a USB token that was US$246 last year is now US$434 from GlobalSign. The lower prices you see some places are for 2+ years.

Note that the certificate itself is only for 1 year regardless of how long you buy one for and you need to go through the renewal process each year just without payment.

by JohnTHaller

2/14/2026 at 5:20:28 PM

Orange? It's a blue warning isn't it? Is this how one of us finds out he's colour blind?

by rustyhancock

2/14/2026 at 5:24:11 PM

The UAC dialog for unsigned software has an orange or yellow accent. You could be talking about the SmartScreen dialog. There's yet another dialog for executable files downloaded from the internet, which I think has a red shield for unsigned software.

by fuzzy2

2/14/2026 at 5:22:37 PM

Blue when it has a valid signature.

Orange when it's missing or invalid.

by tokyobreakfast

2/14/2026 at 6:29:32 PM

I use winget or homebrew, those tools do so for me and if something doesn't match they show an error.

by ozim

2/14/2026 at 10:27:06 PM

Neither WinGet nor Homebrew packages/formulae provide authenticity checks. They have integrity checks for file transfer. That’s it. Where did the file come from when it was entered into the respective repository? No statement.

Whether Authenticode provides a sufficient authenticity check is yet another question, of course. Still, file integrity verification is just a side-effect.

by fuzzy2

2/15/2026 at 4:19:04 AM

It says the code signing cert has been revoked by now.

How does verification work? Only at installation time or will it prevent running the installed files later if installation happened when the cert was still accepted?

Linux user asking out of curiousity...

by usr1106

2/14/2026 at 9:26:34 PM

The .com site serving malware aside, it's how people even get to downloading this. PC builder [...], USB stick [...], YouTube tutorial for a new build [...] instructed to download. Makes me wonder, is this how "PC builders" build PCs, or was this a regular user person. Archive managers are such basic software that I'd think surely someone would keep a stash of (trusted) installer files for the basic tools to be installed in a new environment. At least that's what we used to do, like, 25 years ago. Or use choco, winget or whatever. Malware hygiene habits remain almost unchanged - don't click that link.

by wowczarek

2/14/2026 at 6:39:02 PM

I've started using winget to install my apps for exactly this reason. I can't keep track of every url for every piece of software.

by bloaf

2/14/2026 at 8:01:56 PM

Is that safe? Microsoft's policy [1] seems to say that anyone can publish an update to a package as long as it passes "an automated process" which checks that it's "not known to be malicious".

[1] https://learn.microsoft.com/en-us/windows/package-manager/pa...

by ptx

2/14/2026 at 10:33:59 PM

It’s not. And it gets worse. A WinGet package can suddenly be introduced for software you have already installed and then the next "update all" will install whatever. Could be something completely different!

WinGet is not only unreliable, it is but one step removed from Remote Code Execution as a Service. Well, maybe one-and-a-half, if package repo maintainers were to pay attention, but that’s not realistic.

by fuzzy2

2/15/2026 at 3:50:25 AM

It would have prevented both this 7zip attach and the recent notepad++ one.

by bloaf

2/15/2026 at 3:05:08 PM

The only solutions for the malicious domain would be lawsuits or hactivism. As others have said it is blocked in uBlock by default which everyone should be using at a bare minimum.

by Bender

2/15/2026 at 9:10:54 AM

I usually check some other reliable source for official web address. Earlier I used Wikipedia. Recently found out Softorage, so using that nowadays.

by pendingrunner

2/15/2026 at 8:08:24 AM

I always go through Wikipedia if I want to download software for this exact reason.

by NameNickHN

2/14/2026 at 5:44:06 PM

It doesnt help that many services use a few domain names, bonus points if other ones look like from scam domain examples

by high_na_euv

2/14/2026 at 4:38:23 PM

i'm increasingly convinced nothing good ever comes from youtube tutorials

by throawayonthe

2/14/2026 at 4:59:59 PM

The recent openclaw videos are the best. “Ten openopenclaw skills that will change your life!” Ends up being useless YouTube metrics and a glorified egg drop.

by whatwhaaaaat

2/14/2026 at 5:49:13 PM

remember when we could downvote the bad ones?

by NooneAtAll3

2/14/2026 at 7:22:03 PM

[dead]

by kevincloudsec

2/14/2026 at 10:58:53 PM

> residential proxy node and sells your IP address to third parties for fraud, scraping, and ad abuse.

I know the potential for bad actors here, but there is legitimate use of these services.

I used to work in the “brand protection” space. Our entire business model was SOC-aaS, scraping, verifying, and ending lookalike sites among other threats. If you’ve banked at Wells Fargo or had an iCloud account, our job was to try and make that a little bit safer.

Fact is the enemy gets a vote and quite many so-called threat actors are buying very capable kits that know what the fingerprint of a clean room virtual instance or VPN looks like.

by antonymoose

2/14/2026 at 11:21:41 PM

Maybe this is too obvious to say but it doesn't matter what they're selling the access for, it's the unwanted installation of the proxy that's malware. If you're buying access from a service that gets its residential network access that way you're contributing to the problem.

by hcs

2/14/2026 at 9:25:24 PM

> It's a fundamentally different threat model and most endpoint protection isn't looking for it because the behavioral signatures look like normal network activity.

Is it even possible for a prosumer home router like OPNsense or OpenWRT to detect this?

by ValentineC

2/14/2026 at 11:31:33 PM

For the router itself? No. For the 'prosumer' admin? Sure.

How many prosumers or otherwise network admins filter outbound traffic though? And of the select few that do—how many are actually 'inspecting' say, outbound TCP/443 (e.g., monitoring traffic volume, looking up destination addresses, and/or inspecting SNIs) for example?

by nickburns

2/14/2026 at 11:29:39 PM

Also, official website is 7-zip.org, not 7zip.com

by QuantumGood

2/14/2026 at 7:34:04 PM

> Your machine runs a little slower, your bandwidth gets a little thinner, and someone halfway around the world is routing traffic through your home IP.

I wish in 2026 the default on new computers (Windows + Mac) was not only "inbound firewall on by default" but also outbound and users having to manually select what is allowed.

I know it is possible, it's just not the default and more of a "power user" thing at the moment. You have to know about it basically.

by MuffinFlavored

2/14/2026 at 7:54:56 PM

As a power user I agree, but how do you avoid it being like the Vista UAC popups? Everyone expects software to auto update these days and it's easy enough to social engineer someone into accepting.

by TomatoCo

2/14/2026 at 10:36:40 PM

I do this outbound filtering but I don't use a computer running Windows or MacOS to do it

It doesn't make sense to expect the companies promoting Windows or MacOS to allow the user to potentially interfere with their "services" and surveillance business model

Windows and MacOS both "phone home" (unfiltered outgoing connections). If computer owners running these corporate OS were given an easy way to stop this, then it stands to reason that owners would stop the connections back to the mothership. That means loss of surveillance potential and lost revenue

As of 2006, still nothing stops anyone from setting the gateway of their computer running a corporate OS to point to a computer running a non-corporate OS that can do the outbound filtering

by 1vuio0pswjnm7

2/14/2026 at 7:54:57 PM

Even if it was a default there is so many services reaching out the non-technical user would get assaulted with requests from services which they have no idea about. Eventually people will just click ok with out reading anything which puts you back at square one with annoying friction.

by tempest_

2/16/2026 at 8:05:55 PM

[dead]

by phucnet

2/14/2026 at 5:57:23 PM

I would not trust any sw from Russia. Could be a vector for the FSB. I'm sure they have thought about it.

by jas39

2/14/2026 at 6:09:53 PM

The same could be said for software from the US. Could be a vector of CIA. For average US citizens, it might even be safer to use Russian software because FSB can't come after them.

by jan_Sate

2/14/2026 at 6:13:28 PM

Funny thing that it's exactly the same for Russian citizens - they'd rather use US government malware. Same goes for mail providers.

by n4bz0r

2/14/2026 at 6:23:14 PM

It is not a bad rule, to use online services / software where you know that the malicious owners are likely not after you nor in cahoots with the government where you live. Or you can take the Swiss option with stuff like ProtonVPN, Signal etc. :-)

by einpoklum

2/14/2026 at 6:32:02 PM

Signal is not Swiss, though, although I'd like they to be ;-)

by ale42

2/14/2026 at 5:41:09 PM

I compared https://7-zip.org/a/7z2600-x64.exe with https://7-zip.com/a/7z2600-x64.exe. They are byte-for-byte identical. If there's malware, it isn't obvious.

by Meneth

2/14/2026 at 5:49:48 PM

The OP refers to 7zip.com, no dash. Those dashed domains directly resolve to the same Hetzner server, but the undashed one heads off into Cloudflare.

by jsheard

2/14/2026 at 5:43:59 PM

Seems this all comes down to the wrong domain (.org vs .com).

by ezekiel68