Why File Extensions Still Matter in 2026
Despite years of security awareness training, malicious email and messaging attachments remain one of the most common ransomware entry points. Part of the reason is a small, persistent Windows default: file extensions for known types are hidden from view unless a user manually changes a settings toggle almost nobody knows exists. That single default has powered an entire category of attack — the double-extension disguise.
How Double-Extension Disguises Work
A file named invoice.pdf.exe is, in reality, an executable program — the .exe at the end is what actually determines how the operating system treats it. But with extensions hidden, Windows displays it simply as invoice.pdf, complete with a document-style icon in some configurations. A user who has learned to distrust ".exe attachments" sees exactly the file type they were told to trust, and opens it.
This trick isn't limited to PDFs — photo.jpg.scr, report.docx.js, and archive.zip.bat all follow the same pattern: a familiar, harmless-looking extension followed by a real executable one (.exe, .scr, .js, .vbs, .bat, .cmd, and several others are all capable of running code the moment they're opened).
What Ransomware Leaves Behind
Once ransomware actually runs, it typically does two things that are highly detectable after the fact:
- Renames or re-extensions encrypted files — extensions like
.locky,.wcry,.crypt,.phobos,.djvu, and.lockbitare all signatures of specific, previously documented ransomware families appended to files after encryption. - Drops a ransom note in every affected folder — filenames like
_readme.txt,HOW_TO_DECRYPT.html, or!!!READ_ME!!!.txtare consistent enough across campaigns that their mere presence is a strong indicator something has already gone wrong.
Seeing either of these on a real system, especially spreading across multiple folders, should be treated as an active incident — disconnect the affected device from the network immediately and do not try to open the ransom note or pay before consulting an incident response professional.
Step-by-Step: Checking a Suspicious File Before Opening It
- Turn on file extensions. On Windows, enable "File name extensions" in File Explorer's View tab so double extensions become visible by default.
- Read the full filename, right to left. The extension that actually matters is the very last one.
- Check the sender and context. An unexpected attachment, even from a known contact whose account may be compromised, deserves a second look.
- Cross-reference the extension against known ransomware-associated extensions and ransom-note filename patterns before opening anything unfamiliar.
- When in doubt, don't open it locally — ask IT/security to inspect it in an isolated environment first.
Extensions are a small detail, but they are one of the few reliable signals available before a file actually runs. A quick pattern check across a batch of filenames — attachments, downloads, or files already on a suspicious drive — takes seconds and catches both the well-known ransomware markers and the disguise techniques built specifically to get past a distracted glance.
Backups Are Still the Real Insurance Policy
Recognizing a dangerous filename before opening it prevents an infection from starting in the first place, but it isn't a substitute for having a real recovery plan if prevention ever fails. Ransomware families evolve constantly, and a curated extension list, however current, will always trail slightly behind whatever a new campaign starts appending to encrypted files. Offline or immutable backups — a drive that isn't permanently connected, or a backup service with version history ransomware can't overwrite — remain the only reliable way to recover files without paying anyone.
The combination is what matters: catching suspicious filenames stops the majority of infections at the door, while working backups mean that even the rare attack that gets through doesn't turn into a permanent loss. Neither one alone is a complete strategy, and relying on just one of them is exactly the gap ransomware operators count on.