Any ZIP file linked to this ecosystem—including one named offpos104nulledzip —likely contains code that reproduces the infection chain described above.