That you should not open an .exe from an unknown email has got around. Which is precisely why dangerous attachments now arrive as invoices, delivery notes or job applications — in formats nobody considers dangerous.
Office files: macros
Word, Excel and PowerPoint can contain program code, so-called macros. Originally intended for automation, they can also download and execute files.
The usual sequence: the document opens and shows blurred, apparently protected content with a note that you must "enable editing" to see it. That very click starts the macro.
Microsoft now blocks macros in files from the internet by default, which has helped a great deal. It gets bypassed via containers: the file arrives inside an archive or a disk image, which loses the mark-of-origin.
Practical rule: a document asking you to enable anything is an attack. Legitimate files do not need it.
PDF: more than a picture of paper
A PDF is not a static image but a container with its own language. It can contain:
- JavaScript. Historically intended for form logic, repeatedly a target for vulnerabilities.
- Embedded files. A PDF can carry other files that open with a click.
- Automatic actions. Such as a redirect on opening.
- Forms that submit data. Filled in and sent, they land with the attacker.
The most common case is more mundane though: the PDF simply contains an image and a link to a fake sign-in page. No malicious code, nothing for a scanner to find — the attack only happens in the browser.
The inconspicuous formats
- Archives (
.zip,.rar,.7z). Hide the contents from simple checks. An encrypted archive with the password in the message body is a clear warning sign — its only purpose is to defeat scanning. .iso,.img,.vhd. Mount as a drive on double-click. Files inside no longer carry the mark-of-origin..lnk. Looks like a shortcut but can run arbitrary commands..svg. An image file that can contain HTML and JavaScript. Opened in a browser it becomes a web page.- Double extensions.
invoice.pdf.exe— Windows hides the final extension by default.
What helps
- Were you expecting this file? An unexpected invoice from a provider you never ordered from is always suspicious.
- Enable nothing. Not macros, not editing, not "leave protected view".
- Show file extensions. In Explorer, under View, turn on filename extensions.
- Open in the browser. View PDFs in your browser or webmail preview rather than a local application — those run in a sandbox.
- When in doubt, ask, through a channel you chose yourself. Not the number in the email.
What we do
We refuse around forty executable file extensions outright. That stops the crude cases and is explicitly not antivirus: renamed malware or malware packed into an archive gets through, and a PDF with a link to a fake sign-in page looks harmless to any check. Treat attachments in an open mailbox accordingly — we run no virus scanner and would rather say so plainly.