Dangerous email attachments: how to spot one before you open it

Published: 2026-07-31

Attachments are half the reason email still matters — tickets, invoices, books, photos all arrive as files. They are also the oldest working way to get something harmful onto a computer, and it still works, because it does not attack the machine. It attacks the moment of curiosity: a file with your name on it.

This page is the plain version of that risk. What actually makes a file dangerous, how the classic disguises work — including the invisible characters that can make a file name read backwards — what the marks on this site do and do not mean, what your operating system already stops on its own, and the short check that takes half a minute and catches almost everything.

What the marks next to a file here mean

When a message arrives with an attachment, this site reads the file's name — cleans it of anything invisible (more on that below), ignores trailing dots and spaces, and looks at the extension. Depending on what it finds, the file gets one of two marks, or none:

Nothing is blocked at any level: the file is yours, and the decision is yours. The two marks exist because a single colour for everything either frightens people away from ordinary invoices or says nothing about the file that will actually cost them — and after a few false alarms, nobody reads warnings at all.

Why a file can be dangerous at all

It comes down to one question: can this file cause code to run? There are three answers, and they are worth telling apart.

• The file is a program. Opening it and running it are the same action. Nothing has to go wrong, nothing has to be exploited — you asked the system to run it, and it did.
• The file contains active content. Office documents can carry macros; a PDF can carry scripts and embedded objects. Here the code does not run on its own — modern apps open the document in a read-only mode first and ask before enabling anything. The attack is therefore aimed at the button you press, not at the software.
• The file exploits a bug in whatever opens it. A malformed image or document that crashes the viewer in a useful way. This is the rare and expensive case, and it is exactly what security updates close — which is why an up-to-date system matters more than any single precaution on this page.

The double-extension trick: family_photo.jpg.exe

This is the oldest disguise still in daily use, and it is not a technical exploit at all — it is a setting.

Windows hides the extensions of known file types by default. So a file genuinely named family_photo.jpg.exe is displayed in Explorer as family_photo.jpg: the real extension, the one that decides what happens on double-click, is the part that got hidden. Add an icon that looks like a photo thumbnail — an executable can carry any icon its author chooses — and the disguise is complete. You double-click a picture; a program starts.

Turn extensions back on — it takes ten seconds and it is permanent:

• Windows 11: open File Explorer → View → Show → tick File name extensions.
• Windows 10: File Explorer → View tab → tick File name extensions.
• macOS: Finder → Settings → Advanced → tick Show all filename extensions.

Icons lie too

The icon is chosen by whoever built the file. A program can wear the icon of a PDF, a Word document, a folder, or a photograph of a cat — it is a picture stored inside the file, and nothing checks that it tells the truth. The icon is decoration; the extension is the fact. The reliable move is to judge the file after it lands, by the type your system reports for it with extensions visible, not by how it looked in a list.

The invisible characters: when the name itself is a lie

This one deserves its own section, because it is genuinely surprising the first time you meet it, and because almost nobody outside security work knows it exists.

Text on a screen is not just letters. Unicode — the alphabet of alphabets that computers use — also contains characters that are not drawn at all. They exist to give instructions to whatever is rendering the text: write the next part right-to-left, allow a line break here, join these two letters. They are indispensable for Arabic and Hebrew, where a line can legitimately run in both directions at once. And they work inside a file name exactly as they work inside a sentence.

The right-to-left override (U+202E)

The famous one. This character means “display everything after me in reverse order”. So an attacker names a file:

photo_annexe + (invisible U+202E) + gnp.exe

and your eye reads photo_annexeexe.png — a picture. The name stored on disk is unchanged: the last extension is still .exe, and double-clicking still starts a program. Nothing was hacked. The text was simply asked to be shown backwards, and it obliged.

The relatives

• Zero-width characters (U+200B–U+200D, and the byte-order mark U+FEFF) take no space at all. Dropped into the middle of a word, they let a name read as document.pdf while being something else to any code that compares names — and they defeat naive filters that simply search for the text “.exe”.
• Directional marks and isolates (U+200E, U+200F, U+2066–U+2069) are the milder cousins of the override: they flip or fence off a fragment rather than everything that follows.
• A long run of spaces. Not a special character at all — just fifty of them. invoice.pdf · fifty spaces ·.exe fits perfectly into a narrow column: the visible part ends at the fake extension, and the real one sits far off to the right where the list cuts it off.
• Look-alike letters. Cyrillic е, а, о and Greek ο are different characters that draw the same shape as their Latin twins — the same trick as look-alike domain names, which is covered in punycode email domains.

What this site does about it

Before a file name is shown to you, these characters are removed from it: the direction overrides, the isolates, the zero-width family, control characters, and runs of spaces are collapsed to one. What you read in the attachment list is therefore the name as it really is, in the order it really is.

And because an ordinary sender never has a reason to put an invisible override in a file name, its presence is treated as a signal in itself: a file whose name contained hidden characters gets the grey ℹ mark even when the extension looks harmless.

The families worth knowing

What your system already does without being asked

It is worth saying plainly, because the internet tends to describe every attachment as a loaded weapon: a current, updated system stops the great majority of this on its own.

• Downloads are marked. Windows and macOS tag files that came from the internet. That mark is what triggers the extra warnings later, and why the same file copied from a USB stick behaves differently.
• Unknown programs get challenged. Windows SmartScreen shows a full-screen “Windows protected your PC” panel for an unrecognised executable; macOS Gatekeeper refuses to open software that is not notarised. Both require a deliberate override.
• The built-in antivirus is real antivirus. Microsoft Defender scans on access, out of the box, and scores as well as most paid products in independent tests.
• Office documents open locked. Protected View opens anything from the internet read-only, and macros in files from the internet are blocked outright by default — not just discouraged.
• Browsers screen downloads and refuse the most obviously dangerous types outright, and phones will not install an app from a file without an explicit permission you have to grant by hand.

The 30-second check

1. Did you ask for this? A file you expected, seconds after you filled in the form that produces it, is a different thing from a file that simply arrived. Context outweighs every other signal on this list.
2. Read the whole name, extension included. Two dots where one belongs is the answer on its own.
3. Does the type match the story? An invoice is a PDF. An invoice that is an .exe, or a .zip containing a .js, is not an invoice.
4. Is the pressure artificial? “Account closing today”, “final notice”, “confirm within 24 hours” exist to stop you from doing steps 1–3.
5. Open documents in a viewer first. A browser preview, a phone, an online viewer — anything that is not the full desktop application with your files and your accounts behind it. And never press Enable content.
6. Never type a password into something an attachment opened. If a file shows you a login page, close it and go to that site yourself, by typing the address.
7. When in doubt, scan it. A public multi-engine scanner such as VirusTotal is a reasonable second opinion — but remember that anything you upload there becomes available to its subscribers, so do not upload private documents.

If you already opened it

1. Disconnect from the network — Wi-Fi off, cable out. It stops what is running from reporting home or pulling in a second stage.
2. Run a full scan with the built-in protection, not a quick one.
3. Change the passwords that matter — email first, then banking — from another device, because the affected one may be recording what you type.
4. Check the recent sign-in activity on your main accounts and sign out other sessions.
5. Do not settle for deleting the file. It has already done whatever it was going to do; deleting it removes the evidence, not the effect.

Where a generated address helps — and where it does not

A disposable address changes the odds in two useful ways. It carries none of your identity, so a file arriving at it cannot be addressed to you by name and history; and because the address costs nothing, you can walk away from it and everything sent to it the moment it starts attracting rubbish. Nothing here runs the file for you either: attachments sit as data until you deliberately download them.

What it does not change is the part that happens on your own machine. A file opened on your laptop behaves the same whichever mailbox delivered it. So use a generated address to keep the noise away from your real inbox — the practical side of that is in attachments in a generated mailbox — and keep the rules on this page for the moment you double-click anything at all.

Quick answers

Does the amber ⚠ mean the file is a virus?

No. It means the file's extension is one that exists to run code — a program or a script. It might be entirely legitimate software you asked for. The mark tells you what kind of file it is, not what is inside it.

What is the difference between the amber ⚠ and the grey ℹ?

Amber means the file runs by itself once opened. Grey means it needs one more action from you first — enabling content in a document, unpacking an archive, mounting a disc image, typing a password into a page — or that the file name contained hidden characters and therefore cannot be trusted on sight.

Is a .jpg or .pdf attachment always safe?

Nearly always, on an updated system — but not by definition. A picture can be crafted to exploit a flaw in the viewer, and a PDF is a common way to deliver a link or QR code to a fake login page. The everyday risk with these two is the content they point you to, not the file itself.

Why does a .zip get only the grey mark?

Because an archive does nothing by itself, and its name says nothing about what is inside it. The grey ℹ is there to remind you that the decision simply moves one step later: unpack it and apply the same rules to whatever comes out. Treat a password-protected archive whose password is in the message body as a deliberate attempt to get past scanning.

Can I be infected just by reading the message?

Reading text and looking at pictures is not the same as running a file, and this is not where the real risk lives. What matters is what you do next: download, open, allow. Keep the decision at that step and you keep the decision.

What is the safest way to open a document I am not sure about?

Somewhere that is not your main computer's desktop application: an online viewer, a phone, or a separate account. If the document then insists you enable editing or content before it will show you anything, that insistence is the answer.

Generate an email address →

← Back to all docs