(Credit: 7zip[.]com)
A website that looks a lot like 7-Zip, a popular free file archive utility, has been distributing malware that can secretly take over a Windows PC.
Antivirus provider Malwarebytes is warning users about 7zip[.]com site after files downloaded from the domain led to Trojan being installed on a Reddit user's PCs. Last month, security researchers in Japan also flagged the threat last month.
The official domain for 7-Zip is 7-zip.org, making it easy to confuse with the malicious .com version. It looks like 7zip[.]com was previously up for sale; around December 2023, it began hosting 7-Zip downloads, according to the Internet Archive.
7-Zip’s official developer, Igor Pavlov, disavows any connection with the .com domain. “We don't know the exact purpose of this ‘7zip.com’ owner,” Pavlov wrote in 2024. “Do not trust ‘7zip.com’ website, and do not use it.”
In a report, Malwarebytes warns that the 7zip[.]com domain hosts downloads to functional copies of the file-archiving tools, but “alongside a concealed malware payload.” During the installation process, the download will deploy a modified build of 7zfm.exe, as well as three other payloads, “Uphero.exe, hero.exe and hero.dll,” designed to spread the malware.
“While initial indicators suggested backdoor‑style capabilities, further analysis revealed that the malware’s primary function is proxyware. The infected host is enrolled as a residential proxy node, allowing third parties to route traffic through the victim’s IP address,” Malwarebytes found. The residential proxy network can lead to the malware creator selling such access to fuel cybercrime.
The same malware is also using techniques similar to other Trojans “under names such as upHola.exe, upTiktok, upWhatsapp, and upWire,” Malwarebytes added, citing computer code that also references VPN and proxy brands.
The lookalike domain is also still serving malware, according to Malwarebytes. But many mainstream antivirus engines can detect and remove the threat.
Malwarebytes also points out that the Reddit user who sourced the download from 7zip[.]com did so after watching a YouTube video recommending the site. “This shows how attackers can exploit small errors in otherwise benign content ecosystems to funnel victims toward malicious infrastructure at scale,” the antivirus provider added.
About Our Expert
I've been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite internet services, cybersecurity, PC hardware, and more. I'm currently based in San Francisco, but previously spent over five years in China, covering the country's technology sector.
Since 2020, I've covered the launch and explosive growth of SpaceX's Starlink satellite internet service, writing 600+ stories on availability and feature launches, but also the regulatory battles over the expansion of satellite constellations, fights with rival providers like AST SpaceMobile and Amazon, and the effort to expand into satellite-based mobile service. I've combed through FCC filings for the latest news and driven to remote corners of California to test Starlink's cellular service.
I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. In 2024 and 2025, the FTC forced Avast to pay consumers $16.5 million for secretly harvesting and selling their personal information to third-party clients, as revealed in my joint investigation with Motherboard.
I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. I'm now following how the AI-driven memory shortage is impacting the entire consumer electronics market. I'm always eager to learn more, so please jump in the comments with feedback and send me tips.
- PC Game Launcher for Goddess of Victory: Nikke Hacked To Spread Malware
- Miss Small Phones? The 5.3-Inch 'Enough Phone' Will Try To Fill the Void
- Ram Altman? OpenAI's CEO Tries to Defuse Controversial Memory Comments
- US Voters Reject AI Data Centers, Elon Musk Finds Solace in Orbital Alternative
- Got a First-Gen, Circular Starlink Dish? SpaceX to Offer Free Replacement
- More from Michael Kan
