Dangerous Email Attachments: How Disguises Work & How to Spot Them

Malicious email attachments remain one of the oldest attack vectors on the internet—not because operating systems are defenseless, but because attackers design filenames and lures to trick human curiosity into clicking *Run* or *Enable Content*.

On Email Generator, binary attachments are stripped automatically on public disposable inboxes (see Email Attachments & Temporary Mailboxes). However, understanding how attachment disguises work protects you every day in your personal and work email clients.

Three Ways an Attachment Can Execute Code

1. Direct Executables & Scripts: Files ending in .exe, .msi, .scr, .bat, .cmd, .ps1, .vbs, .js, .hta, or .jar are programs—opening them runs code directly.
2. Documents With Active Content (Macros): Office files (.docm, .xlsm) or disk images (.iso, .img, .lnk inside .zip archives) try to persuade you to click *Enable Content* or bypass Protected View.
3. Password-Protected Archives: Attackers frequently send an encrypted .zip or .7z with the password written in the email body specifically so cloud antivirus scanners cannot inspect the executable hidden inside.

Disguise #1: The Double-Extension Trick (invoice.pdf.exe)

By default, Windows File Explorer hides known file extensions. A file named invoice_2026.pdf.exe appears on screen simply as invoice_2026.pdf—often paired with a fake PDF icon embedded in the executable!

Ten-second permanent fix—turn file extensions on: - Windows 11: Open File Explorer → View → Show → check File name extensions. - Windows 10: Open File Explorer → View tab → check File name extensions. - macOS: Finder → Settings → Advanced → check Show all filename extensions.

Disguise #2: Invisible Unicode Right-to-Left Override (U+202E)

Unicode includes an invisible directional formatting character (U+202E, Right-to-Left Override) created to support Arabic and Hebrew text. Placed inside a filename, it instructs the screen to render the characters after it backwards:

• Stored filename on disk: report_[U+202E]fdp.scr
• Displayed visually to your eye: report_rcs.pdf

Because the operating system still reads the true suffix (.scr, a Windows screensaver executable!), double-clicking launches code. Attackers also use fifty consecutive spaces (invoice.pdf .exe) to push the real extension outside narrow UI columns.

Built-In Protections Your OS Already Provides

Modern updated operating systems block most opportunistic attachment attacks automatically—*unless you override their warnings*:

• Mark-of-the-Web (MotW): Windows and macOS tag downloaded files so SmartScreen and Gatekeeper challenge unsigned executables.
• Office Protected View: Microsoft Office blocks macros from internet files by default.
• Built-In Endpoint Protection: Microsoft Defender and macOS XProtect scan unpacked files on access.

The 30-Second Safety Checklist Before Opening Any File

1. Did you request this exact file? Unexpected "urgent invoices" or "shipping notices" are phishing until proven otherwise.
2. Inspect the real final extension with OS filename extensions turned on.
3. Never unlock a password-protected `.zip` from a stranger.
4. Never enter your email or banking password into an HTML file or QR code attached to an email.