How Polyglots Exploit Parsing Differences
Different file formats validate files from different offsets. JPEGs read from byte 0 forward looking for FF D8. ZIP archives read from the end of the file backward looking for the Central Directory record.
By combining both structures into a single file, a polyglot passes image upload security checks while functioning as a valid archive when unpacked.
Key Investigative Takeaway
Inspecting the byte offsets before and after EOF is the only reliable way to detect polyglot carriers.