A friend sent me a link to a ZIP file through a chat message. Nothing about the situation is obviously unusual, but they have been communicating a little strangely, so I'm worried their account may have been compromised. I'm not very experienced with checking downloads for malware. What steps should I take before opening the file, and is there any reasonably safe way to scan it?
4 Answers
The safest choice is to avoid the ZIP unless you can independently confirm it was intentional and have a good reason to receive it. A friend’s account can be compromised without them realizing it, so familiarity alone doesn’t make an attachment safe.
If you’re already unsure, don’t download or open it on your everyday computer. Contact your friend through another channel, such as a phone call or separate messaging service, and ask whether they really sent the file. That also gives them a chance to discover and secure a compromised account.
If you do download it, keep it away from your main device and personal accounts. A disposable virtual machine or isolated test computer is safer, though it still isn’t foolproof. When there’s no clear reason for the archive or the sender can’t confirm it independently, deleting it is the best option.
If you absolutely need to inspect it, use an up-to-date security tool and scan the file before extracting anything. You can also use a reputable multi-engine malware scanner, but avoid uploading private or sensitive files because uploaded samples may be retained or shared. Don’t disable security warnings or run any program or script from the archive just to see what it does.
The fact that it’s a ZIP and the message sounds unusual doesn’t prove it’s malicious, but it’s enough reason to pause and verify it before downloading.