Short answer: No, do not download 7-Zip from 7zip.com. That site is not operated by the 7-Zip developer. The official site is 7-zip.org, run by Igor Pavlov, and he has written that he does not control 7zip.com and that people should not trust or use it. In February 2026, Malwarebytes reported that 7zip.com served a trojanized installer that worked as 7-Zip but also turned the PC into a residential proxy node. If you installed 7-Zip from 7zip.com, Malwarebytes advises treating that PC as compromised. To check a copy you already have, compare its SHA-256 with the official release listing.
Official-source review — 24 October 2026 UTC: We checked 7-zip.org and its download page, the 7-Zip GitHub releases for 26.05 and 26.03, the SourceForge project and support request #559, and the Malwarebytes report. We did not visit 7zip.com, download anything from it, or run or scan its installer. Everything we say about that installer comes from Malwarebytes. On 23 October 2026 at 23:23 UTC we downloaded 7z2605-x64.exe (7-Zip 26.05, 1,663,506 bytes) from the project’s GitHub release, which is where 7-zip.org’s download button points, and did not run it. Its SHA-256 was fd99e86f57d8f429ef5ed045bf98315af962e2309b0f1ba87a147a44c71647d0, matching the digest on the GitHub 26.05 release page, and Windows reported it as not code-signed. An earlier check of the 26.03 x64 installer from 7-zip.org showed the same: unsigned, with a hash that matched GitHub’s listing.
Is 7zip.com safe?
7zip.com is not the 7-Zip project’s website. The question was put to the developer directly in support request #559, titled “7zip.com vs 7-zip.org”, on the official SourceForge tracker on 20 May 2024. A user asked whether www.7zip.com was a mirror or a phishing site and noted that it hosted older versions. Igor Pavlov replied the same day. He said he does not control the 7zip.com domain, that its owner shows pages that look like the 7-Zip site, and that he does not know the owner’s purpose. He guessed it might be traffic for reselling the domain or for advertising. His advice was plain: do not trust the 7zip.com website and do not use it.
That was 2024. In 2026 a security vendor reported a much more serious problem with downloads from the same domain.
What Malwarebytes reported about 7zip.com in 2026
On 9 February 2026, Stefan Dasic of Malwarebytes published “Fake 7-Zip downloads are turning home PCs into proxy nodes”. According to that report:
- The operators behind 7zip.com distributed a trojanized installer. It installed a working 7-Zip File Manager, so nothing looked wrong, and also placed hidden components.
- The installer was Authenticode-signed with a now-revoked certificate issued to Jozeal Network Technology Co., Limited.
- Three files were dropped in
C:\Windows\SysWOW64\hero\:Uphero.exe,hero.exeandhero.dll. They were registered as auto-start services running as SYSTEM, and firewall rules were changed withnetsh. - Malwarebytes concluded that the main purpose was proxyware: the infected PC becomes a residential proxy node that other people’s traffic can pass through.
- The case started with a Reddit user who had followed a YouTube PC-build tutorial pointing to 7zip.com. Microsoft Defender flagged the system almost two weeks later with the generic detection
Trojan:Win32/Malgent!MSR.
Malwarebytes’ guidance is that any system that ran installers from 7zip.com should be considered compromised. It also says reputable security software can remove the components, and that a full reinstall is optional rather than required in every case.
Real 7-Zip sources vs the lookalike
7-zip.org itself tells you which other addresses are official. Its download buttons point to the GitHub account ip7z, and it links the SourceForge project sevenzip for the forum and bug reports.
| Site | Who runs it | What our check found |
|---|---|---|
| 7-zip.org | Igor Pavlov (copyright line on the site) | Current release is 26.05 (2026-10-21). Download links go to GitHub. No SHA-256 values are shown on the site. |
| github.com/ip7z/7zip | The 7-Zip project; linked from 7-zip.org’s download buttons | Each release lists a SHA-256 digest per file. The 26.05 and 26.03 x64 installers we hashed match it exactly. |
| sourceforge.net/projects/sevenzip | The 7-Zip project; linked from 7-zip.org | Forum, bug tracker and release threads. Pavlov answers support requests there. |
| 7zip.com | Not operated by the 7-Zip developer (Pavlov, 2024) | We did not visit it. Malwarebytes reported a trojanized installer from it in February 2026. |
Our download site checker lists 7zip.com as an impostor for 7-Zip, with 7-zip.org as the official domain. For other programs, our guide to fake download sites explains the common patterns.
Why a signed “7-Zip” installer is a warning sign
This sounds backwards, but it matters here. The official 7-Zip 26.05 x64 installer we downloaded has no digital signature. PowerShell’s Get-AuthenticodeSignature reported NotSigned, as it did for the 26.03 installer we checked earlier. The installer Malwarebytes described from 7zip.com was signed, by a company that has nothing to do with 7-Zip.
So the usual rule “signed means safe” does not help with 7-Zip. If you have a 7-Zip installer that shows a publisher such as Jozeal Network Technology, or any other company name, treat it as a red flag. Do not run it. Because the real installer is unsigned, the reliable check is the file’s SHA-256 hash. Our guide on how to check a Windows installer’s digital signature shows how to read the publisher field.
Get-AuthenticodeSignature "$env:USERPROFILE\Downloads\7z2605-x64.exe" | Format-List Status, SignerCertificateHow to check your 7-Zip installer by SHA-256
Open PowerShell in the folder that holds the file and run:
Get-FileHash .\7z2605-x64.exe -Algorithm SHA256Compare the result with the table below, or drop the file into our SHA-256 checker, which hashes it in your browser. Every character must match. If it does not, delete the file and download it again from 7-zip.org.
Where the values come from: all four are the SHA-256 digests shown on the project’s GitHub release page for 26.05, released on 21 October 2026. We also hashed the x64 .exe ourselves on 23 October 2026 UTC, and it matched. Our 7-Zip catalogue page lists the same values.
| File (7-Zip 26.05) | Platform | SHA-256 |
|---|---|---|
7z2605-x64.exe |
Windows 64-bit | fd99e86f57d8f429ef5ed045bf98315af962e2309b0f1ba87a147a44c71647d0 |
7z2605.exe |
Windows 32-bit (x86) | 6435a470fe7c4769962dbed8a60c641ee21401c833ced06077c80e33e7845a5e |
7z2605-arm64.exe |
Windows ARM64 | 86d5790d5dd84cab4636c3bb7fab10d3ed7cd3e57e6119401bd2769e28165268 |
7z2605-x64.msi |
Windows 64-bit MSI | 3fe4ab99fa15629c652944309a2b2bc6e41fc933fc6b63f5df1ebcf3aea68263 |
If you still have an older installer, such as 26.03, compare its hash with the digest next to that file on the GitHub releases page. Our study of Windows installer checksums explains why so few publishers show hashes on their own download pages. If a WinRAR hash does not match, see what a WinRAR SHA-256 mismatch means.
What to do if you installed 7-Zip from 7zip.com
- Disconnect the PC from the network if you can.
- Check for the folder Malwarebytes named:
C:\Windows\SysWOW64\hero\. Also look for Windows services or firewall rules namedUpheroorhero. - Run a full scan with up-to-date security software. Malwarebytes says its product removes the known variants. Microsoft Defender detected the Reddit user’s case.
- Uninstalling 7-Zip alone is not enough, because the reported components run as separate services.
- Change passwords you used on that PC from a clean device, and consider a reinstall of Windows if the PC holds work or financial data.
- Install 7-Zip again from 7-zip.org and verify the hash before you run it.
What this page does not do
We did not analyse the 7zip.com installer and we cannot tell you whether 7zip.com serves the same file today. We only report what Malwarebytes and the 7-Zip developer published. We are not saying every older copy of 7-Zip on your PC is infected. A copy installed from 7-zip.org, GitHub or SourceForge is the genuine project. If you would rather use a different archiver, see our pages for PeaZip and WinRAR, which list their own official sources.
Questions
Is 7zip.com the same as 7-zip.org?
No. 7-zip.org, with the hyphen, is the official site. Igor Pavlov said in 2024 that he does not control 7zip.com.
Is 7-Zip itself safe?
The official program from 7-zip.org is the genuine project. The Malwarebytes report concerns an installer from 7zip.com, not the official release.
Why is the official 7-Zip installer not signed?
7-zip.org does not explain it. We can only report that the 26.05 and 26.03 x64 installers we downloaded had no signature. Use the SHA-256 hash to check it instead.
Is downloading 7-Zip from GitHub safe?
Yes, if it is the ip7z/7zip repository. That is where 7-zip.org’s own download buttons point, and GitHub shows a SHA-256 digest for every file.
Sources
- 7-Zip official site
- 7-Zip download page
- 7-Zip 26.05 release on GitHub (ip7z/7zip)
- 7-Zip 26.03 release on GitHub (ip7z/7zip)
- 7-Zip releases on GitHub
- 7-Zip project on SourceForge
- SourceForge support request #559: 7zip.com vs 7-zip.org
- Malwarebytes: Fake 7-Zip downloads are turning home PCs into proxy nodes (9 February 2026)
- Microsoft Learn: Get-FileHash
- Microsoft Learn: Get-AuthenticodeSignature
