{"success":true,"data":{"id":"archive-password-in-body","label":"Password-protected archive with password disclosed in body — malware delivery","description":"A .zip/.rar/.7z attachment is present AND the body reveals a password to open it. Malware distribution technique: AV scanners can't inspect encrypted archive content (it's opaque until decrypted), so wrapping a malicious binary in a password-protected archive bypasses every on-delivery content scanner by design. The attacker puts the password in the body so the recipient can extract the archive manually. Legitimate use cases exist (HR payroll, legal case files) but they're rare and typically use secure file-sharing links. Not applied to PDFs, which are format-inspectable even when encrypted.","tier":"danger","category":"body","isThin":false}}