How to avoid phishing attachments: the files attackers actually send

An attachment doesn't have to contain a virus to steal your password. Some are fake login pages that open from your own computer. Here is what to look out for, file type by file type.

Most people picture a phishing attachment as a program that infects your computer. Many are nothing like that. Open Remittance_Advice.html and your browser shows a perfect Microsoft sign-in page. No website was visited, no download was flagged, and whatever you type goes straight to the attacker.

In AhnLab's April 2026 sample of phishing email attachments, trojans led at 47% and phishing pages came second at 39%, mostly HTML built to mimic login pages. That's one vendor's data with a Korean focus, but it shows how much of this is about stealing logins rather than planting malware.

What each file type does

File	How the trick works	Check for
.html, .htm, .shtml	Opens a fake login page in your browser, from your own computer	Very few real businesses send these. Treat any of them as hostile unless you asked for it.
.svg	Looks like an image, but SVG files can hold scripts. Some redirect you, and some contain a whole fake login page.	An "image" that opens in your browser and asks for anything
.pdf	Usually harmless itself. It carries a button or QR code that leads to the real trap.	"Click to view document", or a QR code you're told to scan
.zip, .rar, .7z	Hides the real file from a quick look. A password in the email stops scanners from reading it.	A password-protected archive you weren't expecting
.exe, .scr, .js, .vbs, .hta, .lnk, .iso	Runs a program. Often disguised with a double extension such as `invoice.pdf.exe`.	Never open these from an email
.docx, .xlsx with macros	Asks you to "enable content" so a macro can run. Microsoft Office now blocks macros in files from the internet by default.	A yellow bar or a picture telling you to enable editing or content

Why SVG deserves a special mention

People trust images. Cloudflare's research describes SVG attachments that redirect to credential-stealing sites, and others that carry the full fake login page inside the file, encoded in base64. That second kind has no outside link for a scanner to check. File names are chosen to look routine, such as invoice_April.svg. Kaspersky counted 2,825 of these emails in the first quarter of 2025 alone. If a picture opens in a browser tab and starts asking for a password, close the tab.

Tips for avoiding phishing attachments

Turn on file extensions. Windows hides them by default, which is what makes invoice.pdf.exe work. In Windows 11, open File Explorer, then View, Show, File name extensions.
Ask "was I expecting this file from this person?" A hacked colleague's account can send you a real-looking attachment in a real email thread. If it's unexpected, confirm by phone or chat. Don't reply to the email.
Be suspicious of passwords in the message. "The password is 1234" protects nothing, and it stops your scanner from reading the file. Microsoft's own documentation notes that its scanner can't fully check a password-protected attachment without the password.
Never type a password into a file. A document or attachment has no reason to ask you to sign in. If it says you must, close it and sign in to the service directly.
Don't click "Enable content". An invoice doesn't need macros to display. If a file insists, it's the warning sign.
Don't scan a QR code from an email attachment on your phone. It moves you to a device with weaker protection. If you must check one, use our QR code scanner to read the address first.
Check the address it wants you to visit. Paste it into the link checker without opening it.

Careful with online scanners. Uploading a file to VirusTotal shares it with security companies, and the file can be available to others. Fine for an obvious scam, but never upload a real contract, payslip or anything else private. You can look up a file's hash instead, which sends only a fingerprint.

Where a browser extension helps, and where it doesn't

This is worth being straightforward about. An HTML attachment opens from your own disk, as a file:// address. In Chrome and Edge, extensions can't see those pages unless you turn on "Allow access to file URLs" on the extension's details page. So don't assume any browser extension is watching a fake login page opened from an attachment. That includes ours. And an extension can't stop a program once it runs.

It can help with the steps around the attachment. PhishClean's paid download warnings flag disguised files such as invoice.pdf.exe, script files, and files a page assembles inside the browser (known as HTML smuggling). When a PDF or email sends you on to a fake site, the free blocking of reported phishing sites and the password-field check apply.

If you already opened it

You opened a PDF or image and did nothing else: close it. The risk is generally low on an up-to-date computer. Run a scan to be safe.
You typed a password into a page it opened: change that password now from a device you trust, sign out all other sessions, and check for new forwarding rules in your email. Change it anywhere else you reuse it.
You ran a program or enabled macros: disconnect from the internet. On a work computer, call IT right away. Then follow our recovery checklist.

Frequently asked questions

Can you get hacked just by opening an email attachment?

Sometimes. Fully updated software makes this rare, but opening a file can run an exploit in unpatched software. More commonly the attachment needs one more step from you: typing a password, enabling macros or running a program.

Are PDF attachments safe?

Usually the file itself does nothing harmful, but it can contain a button or QR code that leads to a phishing site. Treat links inside an unexpected PDF like links in the email.

Can an SVG image contain malware?

Yes. SVG files can hold scripts. Attackers use them to redirect you to a phishing site, or to show a fake login page inside the file. If an image opens in a browser and asks for your details, close it.

Why would an attachment be password protected?

Real senders do this for confidential files, usually sharing the password separately. Attackers do it because a scanner can't read the contents. A surprise protected file, with its password in the same email, is a warning sign.

Sources

Catch the disguised download

PhishClean warns about fake sign-in pages and, on the paid plan, disguised files before they reach your computer. The 7-day trial needs no card.

Install PhishClean free

Last updated: 5 November 2026