Fake Version of Popular Archiver Site Is Distributing Malware, Taking Over PCs

A website that looks a lot like 7-Zip, a popular free file archive utility, has been distributing malware that can secretly take over a Windows PC.

Antivirus provider Malwarebytes is warning users 7zip[.]com site after files downloaded from the domain led to Trojan being installed on a user's PCs . Last month, security researchers in Japan also flagged the threat last month.

The official domain for 7-Zip is 7-zip.org , making it easy to confuse with the malicious .com version. It looks like 7zip[.]com was previously up for sale; around December 2023, it began hosting 7-Zip downloads, according to the Internet Archive.

7-Zip’s official developer, Igor Pavlov, disavows any connection with the .com domain. “We don't know the exact purpose of this ‘7zip.com’ owner,” Pavlov wrote in 2024. “Do not trust ‘7zip.com’ website, and do not use it.”

In a report, Malwarebytes warns that the 7zip[.]com domain hosts downloads to functional copies of the file-archiving tools, but “alongside a concealed malware payload.” During the installation process, the download will deploy a modified build of 7zfm.exe, as well as three other payloads, “Uphero.exe, hero.exe and hero.dll,” designed to spread the malware.

“While initial indicators suggested backdoor‑style capabilities, further analysis revealed that the malware’s primary function is proxyware. The infected host is enrolled as a residential proxy node, allowing third parties to route traffic through the victim’s IP address,” Malwarebytes found. The residential proxy network can lead to the malware creator selling such access to fuel cybercrime.

The same malware is also using techniques similar to other Trojans “under names such as upHola.exe, upTiktok, upWhatsapp, and upWire,” Malwarebytes added, citing computer code that also references VPN and proxy brands.

The lookalike domain is also still serving malware, according to Malwarebytes. But many mainstream antivirus engines can detect and remove the threat.

Malwarebytes also points out that the user who sourced the download from 7zip[.]com did so after watching a YouTube video recommending the site. “This shows how attackers can exploit small errors in otherwise benign content ecosystems to funnel victims toward malicious infrastructure at scale,” the antivirus provider added.