Why attachments are still a risk
Email filters block many dangerous files, so attackers have become more creative. Instead of attaching an obvious program, they send a document that looks harmless but contains instructions to download something, a zipped file that slips past filters, or an attachment that's really just a link to a fake login page. The attachment is often the hook rather than the payload. Attacks also tend to arrive when you'd expect a file. Fake invoices, delivery notices, CVs sent to a job ad, purchase orders, remittance advice and scanned documents all come with attachments, so staff are used to opening them without a second thought.
File types that deserve extra caution
Be very wary of executable or script files: anything ending in .exe, .js, .vbs, .bat, .scr, .msi or similar. There's almost never a business reason for a supplier to email you a program. Also watch for disk image and shortcut files such as .iso, .img and .lnk, which attackers have used to get past filters.
Compressed files such as .zip, .rar and .7z can hide any of these inside, and password-protected zip files are a particular warning sign because the password stops your email filter from looking inside. HTML attachments that open in a browser are frequently used to display a fake sign-in page stored on your own computer, which avoids link scanning altogether.
The macro warning you should never accept
Word and Excel files can contain macros, small programs that automate tasks. Attackers use them to download malware. A malicious document often shows blurry content with a message like 'This document was created in a newer version, click Enable Content to view'. That instruction is the attack. Don't click it.
Microsoft now blocks macros in files downloaded from the internet by default, which has reduced this risk, but settings can be changed and attackers keep adapting. If your business genuinely relies on macro-enabled spreadsheets from outside, talk to your IT provider about a safer way to handle them rather than training staff to click Enable.
Attachments that are really sign-in traps
Some attachments look like a PDF or document but contain only a message saying 'Click here to view securely', a QR code, or a blurred page with a button. These lead to fake sign-in pages built to look like Microsoft 365, Google or a document-sharing service. Because the PDF itself is harmless, it often gets past filters. A useful rule: if opening an attachment leads you to a page asking for your work email password, stop. You're already signed in to your own email, so a genuine document from a colleague or supplier rarely needs you to sign in again to read it.
A safe routine for unexpected attachments
Ask three questions. Was I expecting this file from this sender? Does the file type make sense for what it claims to be? Does the email read like this person normally writes? If any answer is no, check with the sender by phone or a fresh email, not by replying to the message in question. Preview files in your email app's preview pane or in the browser version of Outlook or Gmail where possible, rather than downloading them. Keep Office, PDF readers and your operating system updated, because many attachment attacks rely on flaws that updates have already fixed.
What the business should have in place
Attachment scanning and sandboxing, where suspicious files are opened in an isolated environment before delivery, catch a lot of malicious documents. Blocking risky file types at the email gateway removes whole categories of threat with no impact on normal work. Endpoint protection on every computer provides a last line of defence if something gets through. Staff should work without local administrator rights, which stops many malicious files from installing anything. Combined with good backups, these layers mean that even if one person opens the wrong file, the damage is contained and recoverable.
Sending attachments safely yourself
Your own habits shape what customers and suppliers expect. If you routinely send documents as links to a sign-in page, recipients learn to type passwords into whatever page appears, which makes them easier for scammers to fool in your name. Where you can, share files in a way recipients recognise and tell them in advance what to expect. For sensitive documents such as payslips or tax records, use your document system's secure sharing with expiry dates rather than plain attachments, and send any password through a separate channel. That protects the information if the email ends up in the wrong inbox.
In short
- Unexpected attachments deserve a check with the sender by another channel.
- Never click Enable Content or Enable Macros on an emailed document.
- Treat zip files, especially password-protected ones, with caution.
- An attachment that leads to a sign-in page is a red flag.
- Email scanning, endpoint protection and no admin rights limit the damage.