Yes, you can get a virus from an email attachment, but in most cases reading the email is not what does the damage: infection starts when you open the attachment and let the code inside it run. Executable files, macro-enabled Office documents, password-protected ZIP archives and disk images such as ISO files are the most common carriers. Protection comes from sender verification, file-type rules, patched systems and a habit of checking before opening.
Key takeaways
- In a modern email client, simply reading a message rarely infects a device; the risk begins when an attachment, macro, script or program is allowed to run.
- The riskiest attachments are executables and scripts (.exe, .js, .vbs, .lnk), macro-enabled documents (.docm, .xlsm), password-protected ZIP/RAR files and .iso/.img disk images.
- Attackers dress attachments up as invoices, quotes, orders and delivery notices, so the sender deserves as much scrutiny as the file.
- If you opened a suspicious attachment, disconnect the device from the network, change passwords from another device and tell IT straight away.
- Business email with sender verification, quarantine and the ability to read attachments without downloading them stops the decision resting on one employee's click.
How does malware get in through an email attachment?
A malicious attachment is a file built to run code on your computer when it is opened or when you grant it a permission. The "Enable content" button in a Word document, a shortcut file pulled out of a ZIP, or a program wearing a PDF icon is what sets that code off. It usually then downloads the real payload from the internet: password-stealing spyware, a remote access tool or ransomware.
Attackers rarely send the file on its own; they wrap it in a story. Subject lines such as "Overdue invoice attached", "Please confirm the order form" or "Your parcel could not be delivered" push the recipient to act quickly. That is why malicious attachments usually arrive inside a phishing email, and most of the warning signs in our guide on how to spot phishing emails apply here too.
What do malicious attachments cost a business?
Email remains the most common way into organisations. According to ENISA's Threat Landscape 2025, phishing, including malspam, was the leading initial intrusion vector in the European incidents it analysed, at about 60%. The UK government's Cyber Security Breaches Survey 2025/2026 found that 43% of businesses had a breach or attack in the previous 12 months, with phishing by far the most common type at 38%.
An incident that starts with one opened attachment often ends in ransomware. The Verizon 2026 DBIR reports that ransomware was present in 48% of all breaches. The cost goes well beyond any ransom: stalled production, late invoicing, customer notifications and, where files containing personal data are affected, breach notification duties under data protection law such as Türkiye's KVKK.
Which email attachments are dangerous?
The table below groups attachments commonly seen in business correspondence by risk. "Lower risk" never means "no risk"; the real question is whether you expected that file, from that sender, in that context.
| Attachment type | Example extensions | Risk | Why |
|---|---|---|---|
| Executables | .exe, .scr, .msi, .bat, .cmd | Very high | The program runs as soon as it is opened; almost never legitimate in business email. |
| Scripts and shortcuts | .js, .vbs, .ps1, .hta, .lnk | Very high | They trigger built-in script engines; a .lnk file can carry a document icon. |
| Disk images | .iso, .img, .vhd | High | A double-click mounts them as a drive that can hide a program. |
| Macro-enabled documents | .docm, .xlsm, .pptm, legacy .doc/.xls | High | "Enable content" lets macro code run. |
| Archives | .zip, .rar, .7z (especially password-protected) | Medium to high | They hide the contents; passwords are used to dodge scanning. |
| HTML attachments | .html, .htm | Medium to high | They open fake sign-in pages or "smuggle" files through the browser. |
| PDFs and images | .pdf, .jpg, .png | Low to medium | The danger is usually a link inside; unpatched readers add risk. |
Windows hides file extensions by default, so a double-extension file such as "Invoice_2026.pdf.exe" can appear as "Invoice_2026.pdf". Showing extensions is a cheap precaution.
How can you tell if an email attachment is suspicious?
Before opening an attachment, ask these questions. If any answer is "no" or "not sure", leave the file closed and contact the sender through a channel you already know.
- Was I expecting this file? An "invoice" from a company you never ordered from is the classic trap; our article on fake invoice email scams explains how the ruse works.
- Is the sender's address really that organisation's? Look at the domain, not the display name; a one-letter difference or a different extension is enough of a warning.
- Does the extension match the document it claims to be? There is no legitimate reason for an "invoice" to arrive as an .iso, .lnk or .html file.
- Is the archive password-protected? A ZIP whose password sits in the email body may be designed to hide its contents from security scanning.
- Does the document ask you to enable macros or editing? A genuine invoice or quote does not, and Microsoft now blocks macros in files from the internet by default.
- Is the email pushing urgency and secrecy? Phrases such as "pay today" or "don't share this with anyone" are hallmarks of social engineering.
Technical checks on the sender matter too. A domain's SPF, DKIM and DMARC records make it harder for someone to send email in your name or your supplier's. If an attacker registers a look-alike domain and configures it correctly, however, those checks alone will not catch it.
What should you do if you opened a suspicious attachment?
Act fast: the first few minutes decide whether the problem stays on one computer.
- Disconnect the computer from the network (cable and Wi-Fi), but do not switch it off, so evidence is preserved.
- Tell your IT lead or support provider immediately and note the email's subject and the time you opened it.
- From a different, clean device, change any passwords used on that computer, especially email and banking.
- Find out who else in the company received the same email and have it deleted or quarantined.
- Do not reconnect the device to the company network until it has been cleaned or rebuilt.
- Assess whether files containing personal data were affected and, if so, start the breach notification process.
If account credentials were also stolen, continue with the steps in our guide to the first 24 hours after an email account is compromised. Against ransomware, having an offline copy of your backups and tested restores ready in advance decides whether recovery takes hours or days.
Which safeguards should a business put in place?
No single product or training session is enough; the layers have to support each other. On devices, an up-to-date operating system, patched office and PDF software and reliable anti-malware protection are the baseline. Without administrator rights, one opened attachment struggles to take over a machine.
On the email side, executable attachment types should not be accepted at all, suspicious messages should land in quarantine rather than the inbox, and sender domains should be checked for impersonation. Round this off with regular security awareness training and our cyber security checklist for SMEs. You will find related articles under security and data protection.
How does SmartMail make this easier?
A malicious attachment usually hides behind a sender that looks trustworthy, so SmartMail examines the email that carries it. Every incoming message goes through three groups of checks: identity (SPF, DKIM, DMARC and PTR, recalculated by SmartMail rather than trusting results written by servers along the way), structure (look-alike domains, impersonation using international characters, display-name spoofing, reply-to and link mismatches) and content (the full text assessed with AI). The result appears as a badge next to the sender's name, with a risk score from 0 to 100 and a readable explanation.
Picture a concrete case. A "current invoice" attachment reaches the accounts@ mailbox from an address one letter away from a real supplier's domain. SmartMail flags the look-alike domain and misleading link with its reasons; because the message falls below the trust threshold, it never reaches the inbox and waits, undeleted, in a separate folder. Releasing mail from quarantine is a separate per-mailbox permission that is switched off for new assignments, so not every employee can release a suspicious message on their own.
SmartMail also lowers the risk of legitimate-looking attachments: AI turns them into document cards, such as an invoice, quote, contract or bank receipt, without downloading them, so amounts, dates and parties can be read without saving the file to a computer. Remote images are blocked by default, the message body is shown in an isolated frame, and code-based checks such as SPF/DKIM/DMARC and look-alike domain detection keep running even when the monthly AI allowance runs out. Full details are on the SmartMail product page.
How can Digital Bridge help?
When you move to SmartMail, the Smart360 team prepares and verifies your domain's MX, SPF, DKIM and DMARC records while you follow progress in the panel. Your company administrator sets the quarantine threshold and sees which messages a new threshold would affect before saving it. Through our cyber security consultancy we also cover the layers beyond email: endpoints, backups and your incident response plan. See how SmartMail works with the other products on the Smart360 family page, or get in touch with your questions.
Next step
Review last month's attachment types: if you see .iso, .lnk, .html or password-protected ZIP files, there is a gap in your defences. Then check who can release mail from quarantine in your shared mailboxes. Try SmartMail in the demo, which needs no sign-up; to buy it, use the SmartMail purchase page, and explore the features on SmartMail.com.tr and our product page.