Earlier this month, Google began offering the ability to register ZIP TLD domains, such as bleepingcomputer.zip, for hosting websites or email addresses.

Since the TLD's release, there has been quite a bit of debate over whether they are a mistake and could pose a cybersecurity risk to users.

While some experts believe the fears are overblown, the main concern is that some sites will automatically turn a string that ends with '.zip,' like setup.zip, into a clickable link that could be used for malware delivery or phishing attacks.

For example, if you send someone instructions on downloading a file called setup.zip, Twitter will automatically turn setup.zip into a link, making people think they should click on it to download the file.

When you click on that link, your browser will attempt to open the https://setup.zip site, which could redirect you to another site, show an HTML page, or prompt you to download a file.

However, like all malware delivery or phishing campaigns, you must first convince a user to open a file, which can be challenging.

A file archiver in the browser

Security researcher mr.d0x has developed a clever phishing toolkit that lets you create fake in-browser WinRar instances and File Explorer Windows that are displayed on ZIP domains to trick users into thinking they are opened .zip file.

"With this phishing attack, you simulate a file archiver software (e.g. WinRAR) in the browser and use a .zip domain to make it appear more legitimate," explains a new blog post by the researcher.

In a demonstration shared with BleepingComputer, the toolkit can be used to embed a fake WinRar window directly in the browser when a .zip domain is opened, making it look like the user opened a ZIP archive and is now seeing the files within it.

While it looks nice when displayed in the browser, it shines as a popup window, as you can remove the address bar and scrollbar, leaving what appears to be a WinRar window displayed on the screen, as shown below.

To make the fake WinRar window even more convincing, the researchers implemented a fake security Scan button that, when clicked, says that the files were scanned and no threats were detected.

While the toolkit still displays the browser address bar, it is still likely to trick some users into thinking this is a legitimate WinRar archive. Furthermore, creative CSS and HTML could likely be used to refine the toolkit further.

mr.d0x also created another variant that displays a fake in-browser Windows File Explorer pretending to open a ZIP file. This template is more of a work-in-progress, so has some items missing.

Abusing the phishing toolkit

mr.d0x explains that this phishing toolkit can be used for both credential theft and malware delivery.

For example, if a user double-clicks on a PDF in the fake WinRar window, it could redirect the visitor to another page asking for their login credentials to properly view the file.

The toolkit can also be used to deliver malware by displaying a PDF file that downloads a similarly named .exe instead when clicked. For example, the fake archive window could show a document.pdf file, but when clicked, the browser downloads document.pdf.exe.

As Windows does not show file extensions by default, the user will just see a PDF file in their downloads folder and potentially double-click on it, not realizing it's an executable.

Of particular interest is how Windows searches for files and, when not found, attempts to open the searched-for string in a browser. If that string is a legitimate domain, then the website will be opened; otherwise, it will show search results from Bing.

If someone registers a zip domain that is the same as a common file name and someone performs a search in Windows, the operating system will automatically open the site in the browser.

If that site hosted the 'File Archivers in the Browser' phishing kit, it could trick a user into thinking WinRar displayed an actual ZIP archive.

This technique illustrates how ZIP domains can be abused to to create clever phishing attacks and malware delivery or credential theft.

mr.d0x is known for previous clever phishing toolkits, such as using VNC for phishing to bypass MFA and the Browser-in-the-Browser technique. Threat actors used the latter to steal Steam credentials.