Today, Immersive's Container 7 Research Team have released a lab covering trust abuse to proliferate a malicous 7-Zip installer containing Go compiled malware
In February 2026, security researchers across different organizations exposed a long-running malware distribution campaign targeting users of the popular 7-Zip archiving utility. Operating for an extended period, threat actors behind the operation registered the convincing lookalike domain 7zip[.]com , closely mimicking the legitimate 7-zip.org to distribute trojanized installers that silently convert victims' machines into residential proxy nodes.
What is this about?Brand impersonation attacks represent a critical threat vector where attackers exploit user trust rather than software vulnerabilities. In this campaign, operators created a sophisticated intrusion using a fake 7zip[.]com domain that mirrors the structure and content of the official site, the malicious installer carries a now-revoked code-signing certificate from "JOZEAL NETWORK TECHNOLOGY CO., LIMITED," and victims receive a fully functional copy of 7-Zip that deploys malicious payloads onto the victim machine. These malicious Golang binaries establish persistence, manipulate firewall rules, and transform victim machines into nodes for a residential botnet.
Why is this critical for you and your team?As security teams increasingly focus on advanced persistent threats and zero-day exploitation, this campaign demonstrates how attackers achieve persistent access through social engineering and trust exploitation. Users downloading software from what appears to be a legitimate source, particularly when following online tutorials or search engine results, and bypassing traditional security awareness training. The malware's use of code-signed binaries, legitimate system directories, and SYSTEM-level service persistence means it evades many endpoint security controls designed to catch obvious malware.
Understanding this infection chain and learning to threat hunt for these artefacts is essential for detecting similar tactics in your environment.
Who is the content for?
- Security Analysts
- Threat Researchers
- Threat Hunters
Here is a link to the lab:
Immerser