A password-protected archive is a compressed file, such as a ZIP or RAR, that requires a password before its contents can be extracted or inspected. Attackers use this to hide malware, delay automated scanning, and make it harder for security tools to preview what is inside.
In real attacks, the archive often carries an initial payload, a script, or another stage of a malware chain. The password may be shared in the phishing message, embedded in a separate file, or reconstructed during delivery so the archive is only assembled after the user opens the lure. Defenders watch for encrypted attachments, unusual archive nesting, and browser or mailbox activity that indicates content is being unpacked after delivery. Because encryption blocks easy inspection, organizations often rely on sandboxing, attachment detonation, and policy rules that flag password-protected archives in suspicious email traffic.