Why attachments remain a top attack vector
Despite years of security awareness training, malicious email attachments remain one of the most reliable ways attackers deliver malware. The reason is simple: opening an attachment feels like a routine, low-risk action, especially when it's disguised as something mundane — an invoice, a resume, a shipping confirmation, or a report you were half-expecting anyway.
A thorough check before opening any attachment really comes down to two separate questions: does the filename itself look suspicious, and does the surrounding context (the sender, the timing, the tone) hold up?
Part 1: What the filename can tell you
Filenames are a surprisingly rich source of information if you know what to look for:
- Double-extension disguises. A file named
invoice.pdf.exeis not a PDF — it's an executable program wearing a PDF's name. Windows sometimes hides file extensions by default, which is exactly what this trick exploits: you see "invoice.pdf" and the hidden.exenever registers. - Risky executable extensions. Files ending in
.exe,.scr,.bat,.js,.vbs,.ps1, and similar extensions run code directly on your device. Legitimate documents, images, and invoices are never sent as these file types — there's no reason a real invoice would ever need to be an executable. - Macro-enabled Office formats. Files ending in
.docm,.xlsm, or.pptmcan contain macros — small embedded programs that run when you enable editing. These aren't automatically malicious (some legitimate business documents use macros), but they deserve extra caution, especially from a sender you weren't expecting a macro-enabled file from.
Part 2: The judgment questions that matter
Filename analysis alone isn't enough — plenty of malicious attachments have perfectly normal-looking names. Four context questions catch what the filename can't:
- Do you actually recognize the sender, or does the name just look vaguely familiar?
- Were you expecting this specific attachment, or did it arrive out of nowhere?
- Does the email create urgency or pressure — an overdue invoice, a suspended account, an angry tone?
- Does the sender's actual email domain match who they claim to be, or is it a lookalike or unrelated address?
Any single yes answer to a risk question is worth pausing over. Two or more together should stop you from opening the attachment until you've verified it another way.
How to verify safely
If anything raises a flag, don't reply to the email to ask if it's legitimate — attackers control that inbox. Instead, contact the sender through a channel you already know is real: call them, message them on a platform you've used before, or check with them in person. Only open the attachment once you've confirmed it independently, and even then, keep your antivirus and OS updated so it can catch what slips through.
Frequently Asked Questions
Check for a double extension, like invoice.pdf.exe — the real file type is the very last extension, and Windows sometimes hides it by default. Any executable extension (.exe, .scr, .js, .vbs) attached to something claiming to be a document or image is a major red flag.
Yes — the Suspicious Email Attachment Checklist combines a filename risk analyzer with a four-question judgment checklist to produce one combined risk score. It's a one-time $5.99 purchase — no subscription, no account required.
No, macro-enabled Office files aren't automatically dangerous — some legitimate business documents use macros. But they're flagged as elevated risk because they can run embedded code, so treat one from an unexpected sender with extra caution before enabling editing.
Don't reply to the email to ask — verify through a separate channel you already trust, like calling the sender directly. Only open the attachment after confirming it independently, and keep antivirus software updated as a backup layer.
No. Everything is analyzed locally in your browser using plain JavaScript — there's no network request anywhere in the tool.