Malware in Email Attachments: Safe Handling Rules for a Small Team

An attachment is the easiest way to get code running on a computer, because the person opening it does the work for the attacker. Most of the danger comes from a short list of file types and one habit: clicking "enable content" because the document asked. The rules below fit on an index card, apply to any mail provider or device, and are worth ten minutes at your next team meeting.

Quick answer

Treat every unexpected attachment as untrusted. Never enable macros or "content" in a document that arrived by email. Do not open .html, .htm, .iso, .img, .js, .vbs, .lnk, .scr or executable files from email at all. Preview PDFs and Office files in the mail client or in a viewer before opening in the full application. When in doubt, confirm with the sender by phone, and if something has been opened, disconnect and report immediately.

File types and what to do with them

• Office documents (.docx, .xlsx, .pptx): common and mostly safe, until they ask you to enable macros or content. That prompt is the attack. Modern Office blocks macros from internet files by default; do not override it. Files ending in .docm or .xlsm contain macros by design and deserve a phone call before opening.
• PDF: generally safe to preview. Be wary of PDFs that contain only a button or link to "view document", which is a phishing page in disguise.
• .zip, .rar, .7z: archives hide the real file type from filters and from you. Password-protected archives with the password in the email body are almost always malicious; the password exists to defeat scanning.
• .html, .htm: an attached web page that opens in your browser and shows a fake login form. There is almost no legitimate business reason to receive one. Delete.
• .iso, .img, .vhd: disk images that mount as a drive and run whatever is inside. Never open from email.
• .exe, .msi, .bat, .cmd, .js, .vbs, .ps1, .scr, .lnk: programs and scripts. Most providers block them; if one arrives, it was deliberately disguised. Delete and report.
• Images (.jpg, .png): safe to view. Beware of image files with a double extension such as invoice.png.exe, which Windows may display as invoice.png.

The five rules for the team

1. Expected or not? If you were not expecting an attachment from this sender, verify by phone or chat before opening, even if the sender is a colleague.
2. Preview first. Use the mail client's built-in preview or a viewer that does not run macros or scripts. Open in the full application only if you need to edit.
3. Never enable macros, content, editing, or "protected view off" because a document asked you to.
4. Never enter a password into anything that opened from an attachment.
5. Report anything odd to the security address within minutes, including your own clicks. Speed limits the damage more than anything else.

Settings that do most of the work

• Keep the operating system, browser, and Office applications on automatic updates. Most attachment malware exploits bugs that were fixed months earlier.
• Leave Office's default block on macros from the internet in place, and turn on Protected View for email attachments.
• Turn on file-extension display in Windows Explorer and macOS Finder so double extensions are visible.
• Use a standard user account for daily work, not an administrator account, so an opened file cannot install system-wide.
• Keep the built-in antivirus on and updated. It is not sufficient alone, but it catches the common cases.

If someone opened one

1. Disconnect the device from Wi-Fi and unplug any network cable. Do not shut it down yet if you may need forensic evidence; do shut it down if you have no such need and want to stop activity.
2. Report to the security owner with the sender, subject, file name, and the time it was opened.
3. From a different device, change the password of the mailbox and of any account that was signed in on the affected machine, and revoke sessions.
4. Have the device scanned or, more reliably, wiped and reinstalled from a known-good image before it rejoins the network.
5. Check whether the same attachment reached other mailboxes and delete it from them.

Reduce what arrives in the first place

authentication (proof that email really comes from your company) on your own domain prevents attackers from sending malware to your staff "from" your own addresses, which is the most convincing lure. Publish SPF, DKIM, and DMARC at quarantine or reject; OquMail sets these up with live DNS verification when you connect a domain. Ask suppliers who routinely send documents to use shared links rather than attachments, and do the same yourself, so an attachment from a regular contact becomes unusual enough to notice.

Common questions

Is it safe to open attachments on a phone?

Safer than on a desktop, because mobile operating systems restrict what a file can do, but a phishing page in an .html attachment works just as well on a phone. The rules apply everywhere.

Our accountant sends .xlsm files with macros. What do we do?

Agree a different format (an .xlsx without macros, or a shared workbook in a cloud spreadsheet) or agree that macro files are always announced by phone first and come via a shared folder rather than email.

Will a paid attachment-sandboxing service solve this?

It helps at scale, but a small team gets most of the benefit from the rules above and automatic updates, at no cost.