Email Attachment Safety: What to Open and What to Delete

Every day, your employees receive dozens of emails with attachments — invoices, contracts, reports, spreadsheets. Most are legitimate. But some contain malware that can encrypt your files, steal your data, or give attackers a backdoor into your entire network. The challenge is that malicious attachments often look identical to the real thing, and a single click is all it takes to trigger an attack.

flowchart TD
    A["Email Attachment Received"] --> B["Check Sender Identity"]
    B --> C["Scan with Antivirus"]
    C --> D["Verify File Extension"]
    D --> E{"Safe?"}
    E -->|Yes| F["Open Attachment"]
    E -->|No| G["Quarantine and Report"]
  

Email attachments remain one of the most common delivery mechanisms for ransomware, trojans, and other malware. In this guide, we will break down which file types are dangerous, how to evaluate attachments safely, and what rules your team should follow before opening anything that arrives in their inbox.

Why Email Attachments Are Still Dangerous

Despite decades of awareness campaigns, malicious email attachments continue to be devastatingly effective. Here is why:

• Business necessity: Unlike suspicious links that employees can often avoid, attachments are integral to daily business operations. You cannot tell your team to never open an attachment — invoices, proposals, and reports need to be reviewed.
• Sophistication: Modern malicious attachments are designed to evade antivirus software and email filters. They may use encrypted archives, embedded macros, or multi-stage payloads that do not trigger detection until after execution.
• Contextual relevance: Attackers tailor their attachments to match what the recipient expects. An accounts payable clerk receives a fake invoice. An HR manager receives a fake resume. The context makes the attachment feel legitimate.
• Speed of business: Employees are under pressure to process emails quickly. When a deadline is approaching and a "client" sends a "contract revision," the instinct is to open it immediately.

A single malicious attachment can compromise your entire network. The few seconds it takes to verify an attachment before opening it can save your business from weeks of recovery.

The File Types You Need to Know About

High-Risk File Types: Delete or Verify

These file types can execute code on your computer, making them the most dangerous attachment types. If you receive any of these unexpectedly, do not open them:

• .exe, .com, .bat, .cmd, .scr: Executable files that run programs on your computer. There is almost never a legitimate reason to receive these via email.
• .js, .vbs, .wsf, .ps1: Script files that can execute commands on your system. These are commonly used to download and install malware.
• .msi, .msp: Windows installer packages that can install software — including malware — on your computer.
• .iso, .img: Disk image files that have become increasingly popular with attackers because they can bypass certain security filters.
• .lnk: Windows shortcut files that can be configured to run malicious commands when clicked.

Medium-Risk File Types: Proceed with Caution

These file types are commonly used in business but can also carry malicious payloads:

• .docx, .xlsx, .pptx (with macros): Microsoft Office files can contain macros — small programs embedded in the document that execute when you click "Enable Content." Macros are one of the most common malware delivery methods. If an Office document asks you to enable macros, stop and verify.
• .doc, .xls, .ppt (legacy formats): Older Office formats are even riskier because they handle macros differently and are more commonly associated with attacks.
• .pdf: PDF files can contain embedded scripts and links to malicious websites. While modern PDF readers have improved security, PDFs should still be treated with caution from unknown senders.
• .zip, .rar, .7z: Archive files are frequently used by attackers to bypass email security filters. The compressed file may contain any of the high-risk file types listed above. Password-protected archives are especially suspicious because security tools cannot scan their contents.
• .html, .htm: HTML files can contain phishing pages or redirect scripts. They are increasingly used to deliver credential-harvesting pages that run locally on the victim's computer.

Lower-Risk File Types

These file types are generally safer, but no file is completely risk-free:

• .jpg, .png, .gif: Image files are generally safe, though in rare cases they can be crafted to exploit vulnerabilities in image-viewing software.
• .txt: Plain text files cannot contain executable code and are the safest attachment type.
• .csv: Comma-separated value files are generally safe when opened in a text editor, but can potentially trigger formula injection if opened directly in Excel.

The Five-Point Attachment Safety Check

Before opening any attachment, train your employees to run through this quick mental checklist:

1. Were you expecting this attachment? If you did not request or anticipate this file, treat it with extra suspicion. Contact the sender through a separate channel to confirm they sent it.
2. Do you recognize the sender? Check the sender's email address carefully — not just the display name. Attackers frequently use display names that match real contacts while using a completely different email address.
3. Does the file type match the content? If someone says they are sending an invoice but the attachment is a .exe or .zip file, that is a major red flag. Invoices should be PDFs, not executable programs.
4. Is the email creating urgency? "Open this immediately," "Urgent — review now," or "Your account will be closed" are pressure tactics designed to make you skip safety checks. Legitimate senders do not need you to panic.
5. Does anything feel off? Trust your instincts. If the email feels unusual — wrong tone, unexpected topic, unusual request — take the time to verify before opening.

When in doubt, do not open the attachment. Contact the sender through a known phone number or start a new email thread (do not reply to the suspicious email) to verify the attachment is legitimate.

The Macro Trap: Office Documents That Attack

One of the most common and effective attachment-based attacks uses Microsoft Office macros. Here is how it works:

1. The attacker sends an email with a Word or Excel file attached.
2. When the employee opens the file, they see a message saying something like: "This document was created with an older version of Office. Click 'Enable Content' to view it properly."
3. If the employee clicks "Enable Content," the macro runs and downloads malware onto the computer.

This attack is successful because the prompt looks like a normal Office message, and employees are conditioned to click through dialog boxes to get their work done.

How to Protect Against Macro Attacks

• Disable macros by default: Configure Microsoft Office across your organization to block macros from running automatically. Most employees never need macros for their work.
• Train employees to never click "Enable Content": Unless they are absolutely certain the document is from a trusted source and macros are expected, they should never enable macros.
• Use Protected View: Microsoft Office opens downloaded documents in Protected View by default. Train employees to read documents in this mode and only exit it when they have verified the source.
• Consider file format policies: If your business does not need to receive macro-enabled Office files (.docm, .xlsm), configure your email system to block them entirely.

Password-Protected Archives: A Red Flag

Receiving a password-protected ZIP file should immediately raise suspicion, especially if the password is included in the same email. Attackers use password protection specifically to prevent email security tools from scanning the archive contents. The email typically reads something like: "Please find the attached document. Password: 12345."

Legitimate businesses occasionally use encrypted archives for sensitive documents, but the password should be communicated through a separate channel (phone call, text message), not included in the same email. If you receive a password-protected archive with the password in the email body, verify with the sender before extracting anything.

What to Do If You Open a Suspicious Attachment

Mistakes happen. If an employee opens an attachment and suspects it might be malicious, speed is critical:

1. Disconnect from the network immediately. Unplug the Ethernet cable or turn off Wi-Fi. This can prevent malware from spreading to other systems or communicating with attacker-controlled servers.
2. Do not shut down the computer. Some malware analysis requires the machine to be running. Shutting down can also trigger destructive payloads.
3. Contact IT or your security team immediately. Report exactly what happened: what you opened, when, and any unusual behavior you noticed afterward.
4. Change your passwords from a different device. If you were logged into any accounts on the affected computer, change those passwords from a clean device.
5. Document what you see. Note any unusual pop-ups, error messages, or system behavior. This information helps your security team understand the threat.

What to Do This Week

Email attachment safety is a fundamental skill that every employee needs, regardless of their role. Here are the steps to strengthen your defenses right now:

1. Disable macros organization-wide. Work with your IT team to block macros by default in Microsoft Office across all company devices.
2. Block dangerous file types at the email gateway. Configure your email system to reject or quarantine high-risk attachments (.exe, .js, .bat, .iso, etc.).
3. Train employees on the five-point checklist. Make the attachment safety check a habit, not an afterthought.
4. Establish a "when in doubt, ask" culture. Make it easy for employees to forward suspicious attachments to IT for review without fear of judgment.
5. Test with simulations. Include attachment-based scenarios in your phishing simulations to test whether employees are applying what they have learned.
6. Keep software updated. Ensure that operating systems, Office applications, and PDF readers are patched to close known vulnerabilities that malicious attachments exploit.

Attachments are a necessary part of business communication, and avoiding them entirely is not realistic. But by teaching your team to pause, evaluate, and verify before clicking, you can dramatically reduce the risk of a malicious attachment making it through your last line of defense.