To open or not to open: the email attachments that put you at risk

Have you ever tried to open an “encrypted” email or an urgent document, only to realize with horror that your usual DOCX attachment is actually a file with the extension .docx.exe? Or maybe you received an email supposedly with an invoice, contract, or internal memo attached — only for the file to prove something entirely different from what it claimed to be? If so, you were likely targeted in a malware infection attempt.

Cybercriminals routinely disguise malicious files as harmless documents and archives, banking on recipients blindly clicking without checking the extension. Kaspersky experts analyzed the file formats most frequently deployed in malicious email blasts to reveal what really lurks behind these extensions — and how attackers weaponize them in their campaigns.

Important note: the extensions we’ll be discussing here are routinely used for completely legitimate files. For example, Windows executables normally end in .exe. However, we’re focusing specifically on scenarios where attackers disguise or spoof a file’s extension to pass it off as a totally different type of file.

What extensions are most commonly found in malware?

Our experts analyzed malicious email blasts from the beginning of 2026 to pinpoint the 15 most common dangerous file extensions.

.exe

.js

.html

.dll

.bat

.vbs

.xls

.pdf

.jse

.au3

.docx

.htm

.wsf

.scr

.lnk

Let’s take a look at what files with these extensions actually do under the hood.

Executable files

An executable file is a compiled computer program that’s ready to run. Once launched, a malicious executable can download additional payloads, alter system settings, steal user data, connect your device to external attacker-controlled servers, and much more. These are the most common executable extensions found in malicious email campaigns:

• .exe
• .dll
• .com
• .scr

.exe

The classic Windows executable extension. It powers every program you use daily, from web browsers and games to office suites and software installers.

By the way, attackers often wrap EXE malware in double extensions: invoice.docx.exe, report.pdf.exe, or even photo.jpg.exe. They take advantage of a default Windows setting: hiding extensions for known file types. Because this setting is turned on by default, users only see the first part of the file name — invoice.docx, report.pdf, or photo.jpg — and assume it’s just a normal document or image. But the second you open this trap file, the malware fires up.

.dll

Another common extension abused in malicious campaigns is .dll (dynamic-link library). These libraries hold functions that Windows programs frequently require while running, such as printing a document. This modular architecture prevents redundant code by letting multiple applications call on the exact same library for specific tasks. However, if an attacker replaces a legitimate library with an infected one, running any normal program that calls on it can trigger malicious code.

.com

While files with the .com extension have absolutely nothing to do with the web domain of the same name, cybercriminals likely count on victims mistaking these files for links in an unusual format. In reality, it’s a legacy Windows executable format.

While modern versions of Windows no longer rely on this file type, the operating system can still run and execute it, which makes opening one a very bad idea.

.scr

SCR files are screensavers — those idle Windows screen animations featuring abstract patterns, the iconic bouncing logo, or whatever else. Despite their harmless reputation, screensavers are essentially executables just like EXE files: once opened, they can install extra components or alter system settings all the same. In malicious campaigns, these files routinely masquerade as images, screenshots, or documents.

Scripts

Scripts are text files containing a sequence of commands that a computer runs automatically in order. They can download files, install and launch programs, modify security settings, and plenty more. Email attackers rely on the following script types most often:

• .js and .jse
• .bat
• .cmd
• .vbs
• .wsf
• .vbe
• .au3

.js and .jse

The .js and .jse extensions are used by JavaScript files. Most users associate JavaScript strictly with websites and don’t realize these files can run locally on their computer as standalone programs.

We recently wrote about CrystalX RAT, a remote access Trojan that logs keystrokes, steals clipboard contents, and injects malicious components into web browsers upon installation. Its JS scripts monitored cryptocurrency wallet addresses and silently swapped them with the attacker’s own to hijack transactions in real time.

.cmd and .bat

BAT and CMD files are designed to automate tasks in Windows and can execute virtually any command in the operating system. Launching a file like this can infect your computer with malware.

.vbs

Visual Basic Script files with the .vbs extension are a long-time favorite among cybercriminals. Attackers frequently use double extensions to disguise .vbs files as plain text documents, such as invoices, app installation guides, or emails. For example, in the early 2000s, the iconic ILOVEYOU worm spread via a VBS script, infecting millions of computers worldwide. Victims received an email with the subject line “ILOVEYOU”, but instead of a sweet confession, the attachment contained a malicious script. At its peak, this “romantic” worm had infected up to 10% of all internet-connected computers.

Web files

This category mainly includes .html, .htm, .hta and .svg files. Often these are phishing pages in disguise, designed to mimic login forms for email, cloud services, banking apps, and other platforms. Naturally, any credentials entered on these fake pages go straight to the attackers hunting for your accounts and money. Web files can also trigger malicious scripts and download additional payloads onto your system.

Archives

Cybercriminals routinely package malicious files inside archives (most commonly having .zip, .rar, and .7z extensions). These archives are often password-protected or encrypted to hinder content scanning. Additionally, attackers sometimes create intentionally corrupted archives with damaged data structures: basic security filters often stumble over broken files and skip scanning them altogether, whereas archive managers can automatically repair and unpack the contents anyway.

That’s why we recommend using advanced security solutions that can spot phishing emails and prevent you from launching dangerous files hidden inside archives.

PDF files (.pdf)

To many, PDF feels like a completely harmless file format — after all, what could go wrong with flight tickets, documents, and slide decks? But beyond static text and images, PDFs can host clickable links, forms, and even scripts.

Malicious code in a PDF is usually tucked away behind visual elements or embedded as hidden text. What’s more, the risk comes not just from the file itself, but also from the software you use to view it: for instance, attackers spent months exploiting a vulnerability in Adobe Acrobat that allowed them to execute malicious PDF files remotely. If you regularly work on PDF documents, make sure the JavaScript feature is disabled in your Adobe Acrobat. To do this, go to Preferences → JavaScript in the menu.

By the way, heavy users of AI agents and chatbots should keep in mind that AI frequently falls for prompt injections: hidden commands buried inside images, text, and web pages that the AI interprets as legitimate instructions, and executes without your knowledge.

LNK shortcuts (.lnk)

Files with the .lnk extension are standard Windows shortcuts that we use every day for quick access to apps and folders. By themselves, shortcuts don’t contain any software — they simply tell Windows what file to open or what command to run.

However, an attacker can give a shortcut any icon and any name they want, completely hiding its real destination. The moment a victim clicks the shortcut, the infection chain kicks off. The malicious code usually executes silently in the background, leaving virtually no visual clues that anything went wrong.

Cybercriminals also like to hide LNK files behind double extensions — betting that users won’t look close enough to see what kind of file they’re actually opening. Here’s a classic example:

Your best bet is to avoid clicking incoming LNK files altogether: no one in their right mind has a reason to email you a desktop shortcut.

By the way, if you haven’t updated Windows in a while, we’ve bad news for you: malicious code can automatically execute without you ever clicking the LNK — simply opening the folder where it lives is enough to trigger it. Microsoft finally released a patch for this long-abused vulnerability in December 2025. So don’t put off system updates — install them regularly to patch up the security holes attackers rely on.

Microsoft Office documents

.xls and .xlsx

The file extension .xls is used by older versions of Microsoft Excel. Millions of people use Excel spreadsheets every day, and many are still running outdated software, which makes XLS files a favorite bait for cybercriminals. Budgets, employee rosters, financial records, urgent reports, and other spreadsheets stop being harmless the moment a user clicks Enable Content, allowing the program to run macros — custom Microsoft Office scripts and commands built into the files. Once allowed, the malicious macro gets free rein to download files, launch programs, harvest system data, and alter settings.

Unlike XLS, XLSX is the modern Excel format, which doesn’t support embedded macros by default. Unfortunately, that doesn’t guarantee complete safety: the spreadsheet can still pull live data from external sources and automatically connect to web destinations in the background.

.docx

Although modern DOCX files don’t support macros by default, attackers have long figured out other ways to weaponize these documents. Typically, malicious DOCX files contain embedded links or instructions that force Word to contact external servers and pull down malicious payloads. Back in 2023, for instance, researchers uncovered a Microsoft Office vulnerability that allowed attackers to trigger built-in Windows system tools and download malware straight from the web.

To reduce your risk when working with Microsoft Office apps, we recommend turning on Protected View, blocking external connections, and disabling all macros without notification.

Macro support in modern Microsoft Office

Macros are sequences of commands that automate complex, repetitive tasks in Excel, Outlook, Word, and PowerPoint. In modern versions of Microsoft Office, documents containing embedded macros are saved in specialized file formats with extensions like .xlsm, .xltm, .xlsb, .docm, and .pptm. While Microsoft Office includes built-in security controls — such as blocking files downloaded from the web and warning you about potentially dangerous macros — if you don’t actually use macros and have no specific reason to run them, treat files with these extensions with caution.

How to check if a file is safe

• Use a comprehensive security suite that automatically scans files for malware, prevents infections, blocks visits to suspicious sites, and completely removes malicious files from your devices. You can take advantage of a 30-day trial of Kaspersky Premium if you urgently need to disinfect your computer or scan a file for viruses.
• Never open attachments from unknown senders. Curiosity can cost you dearly, since many malware strains specifically hunt for credit card and crypto wallet data. Let the Mail Anti-Virus feature included in our security solutions do the heavy lifting: it automatically filters out malicious or suspicious emails and protects you from phishing attacks.
• Examine incoming emails carefully: cybercriminals have become adept at disguising malicious messages. Always verify email addresses against official ones and make sure you know the signs of phishing and spam. Attackers might try to scare you with claims of a hacked account, lure you to shady sites with “unbeatable deals”, or urge you to review a work document attached to the email. Any attempt to manipulate your emotions is a major red flag that someone is trying to trick you.
• Never open files with double extensions. It’s almost always a trap.
• If you run into a file with an unfamiliar extension, take a moment to look it up online. Remember: a photo or plain text document will never have an .lnk or .vbs extension.

Check out our other posts on email and file security:

• Spam 101: what is spam, and how to defeat it
• Phishing 101: what to do if you get a phishing email
• Attackers disguising phishing as Google AppSheet notifications
• Checking QR codes in emails
• How to safely convert files