PfiatDe at BadOption.eu showed how the new .zip top-level domains combine with Windows Explorer into a surprising path to code execution.
Type a name like invoice.zip into Explorer’s location bar, and if nothing matches locally, Explorer looks it up online and maps an attacker’s WebDAV server as a network folder.
Running .exe or .bat files from that share triggers a warning, but .jar files were not blocked the same way, so any machine with a Java runtime installed is in play.
Google Registry opened .zip to everyone in May and answered the criticism by pointing out that confusing domain names with file names is not a new risk.
Netcraft had already found phishing pages impersonating Microsoft, Google and Okta on five of the fewer than 5,000 .zip domains registered by mid-May.
It still needs a user who pastes a path from a “helpful IT department” email, but blocking outbound WebDAV and alerting on java.exe spawning other binaries is cheaper than hoping nobody does.
