An attachment is a program in disguise often enough that it should be treated as one. Many file types are inert documents, but several families can run code, load remote content or hide their real type. Attackers rely on the fact that people open attachments routinely and that the file name is the only thing most people read. This article covers which types to distrust, why some containers defeat scanning, and how to open files with less risk.
File types to distrust
Executables and scripts can run directly when opened. Treat these as hostile unless you requested them and know their origin:
- Windows executables and installers: .exe, .scr, .com, .msi, .msp
- Scripts and shortcuts: .bat, .cmd, .ps1, .vbs, .js, .jse, .wsf, .hta, .lnk
- Disk images that wrap executables: .iso, .img, .vhd, .vhdx
- Markup that can run script: .html, .htm, .svg, .xhtml
- Office files with macros: .docm, .xlsm, .pptm, and older binary formats such as .doc and .xls
- OneNote packages, which have been used to hide embedded launchers: .one, .onetoc2
Some formats are not dangerous by themselves but are common carriers. PDFs can contain links and embedded content, and an Office file without macros can still link to a remote template. Treat them as documents, not as safe by definition.
Double extensions and hidden types
Windows hides known extensions by default in many configurations, so invoice.pdf.exe can appear as invoice.pdf. Some attackers use right-to-left override characters in the file name to reverse the visible part. Check the real type rather than trusting the name. On macOS or Linux, the file command reports what the content actually is:
file invoice.pdf
A result that does not match the extension is a strong reason to delete the message.
Password-protected archives
Encrypted ZIP and RAR archives are a common way to slip payloads past gateways. A scanner cannot inspect the contents of an archive it cannot open, and the password is usually sent in the message body or in a second email. Treat any password-protected archive from an unexpected sender as hostile. Even unencrypted archives deserve a look before extraction. List the contents without extracting them:
unzip -l report.zip
Look for nested archives, executables, and entries whose names do not match the message.
Macros and active content
Office macros are the classic delivery route for malware, and they remain effective when users enable content to make a document "work". If a document asks you to enable macros, the answer for an unexpected file is no. Protected View, which opens files from untrusted sources in a read-only mode, should stay enabled. For a macro-enabled file you must inspect, the oletools suite includes olevba, which lists macro source without running it:
olevba suspicious.docm
Safer ways to open a file
- Verify unexpected files through a second channel before opening them. A phone call or a message to a known address is enough.
- Keep remote content blocked in your mail client. Loading images or stylesheets can confirm to the sender that the message was read.
- Preview files in a view-only context where possible. Cloud previewers still fetch the file, so use them knowing that.
- For anything you must examine, open it in a disposable virtual machine or a separate user account with no access to your real files or credentials.
- Do not strip the Mark-of-the-Web or other zone markers that Windows attaches to downloaded files. They are what trigger the extra warnings.
- Prefer a link to the file on a service you control over a copy in your inbox. You can revoke the link and the file stops being delivered.
What this does not cover
None of these steps makes an attachment safe. Malware exploits bugs in viewers as well as macros, and a file can be harmful without any visible warning. The aim is to reduce the number of files that run without your decision, and to make the decisions you do make deliberately. Keep your operating system, office suite and PDF reader patched, and use a standard user account for daily work.
Phishing messages often arrive with attachments that are designed to look routine, such as invoices, shipping notices and shared documents. The signs are covered in spotting modern phishing. For the account-side checklist, see the security checklist.