User blog comment:DaNASCAT/Technical Update: September 9, 2015/@comment-25801460-20150910214518/@comment-1001528-20150911064658

@SlyCooperFan1 Couple years ago, someone explained how to hide a zip in a png file on their site.

So basically, malware could be hidden in the image file until you try to unzip it.