The top 15 file extensions used in malicious email blasts<\/p>\n<\/div>\n
Let\u2019s take a look at what files with these extensions actually do under the hood.<\/p>\n
Executable files<\/h2>\n
An executable file is a compiled computer program that\u2019s ready to run. Once launched, a malicious executable can download additional payloads, alter system settings, steal user data, connect your device to external attacker-controlled servers, and much more. These are the most common executable extensions found in malicious email campaigns:<\/p>\n
- \n
- .exe<\/li>\n
- .dll<\/li>\n
- .com<\/li>\n
- .scr<\/li>\n<\/ul>\n
.exe<\/h3>\n
The classic Windows executable extension. It powers every program you use daily, from web browsers and games to office suites and software installers.<\/p>\n
By the way, attackers often wrap EXE malware in double extensions: invoice.docx.exe, report.pdf.exe, or even photo.jpg.exe. They take advantage of a default Windows setting: hiding extensions for known file types. Because this setting is turned on by default, users only see the first part of the file name\u00a0\u2014 invoice.docx, report.pdf, or photo.jpg\u00a0\u2014 and assume it\u2019s just a normal document or image. But the second you open this trap file, the malware fires up.<\/p>\n
.dll<\/h3>\n
Another common extension abused in malicious campaigns is .dll (dynamic-link library). These libraries hold functions that Windows programs frequently require while running, such as printing a document. This modular architecture prevents redundant code by letting multiple applications call on the exact same library for specific tasks. However, if an attacker replaces a legitimate library with an infected one, running any normal program that calls on it can trigger malicious code.<\/p>\n
.com<\/h3>\n
While files with the .com extension have absolutely nothing to do with the web domain of the same name, cybercriminals likely count on victims mistaking these files for links in an unusual format. In reality, it\u2019s a legacy Windows executable format.<\/p>\n
While modern versions of Windows no longer rely on this file type, the operating system can still run and execute it, which makes opening one a very bad idea.<\/p>\n
.scr<\/h3>\n
SCR files are screensavers\u00a0\u2014 those idle Windows screen animations featuring abstract patterns, the iconic bouncing logo, or whatever else. Despite their harmless reputation, screensavers are essentially executables just like EXE files: once opened, they can install extra components or alter system settings all the same. In malicious campaigns, these files routinely masquerade as images, screenshots, or documents.<\/p>\n
Scripts<\/h2>\n
Scripts are text files containing a sequence of commands that a computer runs automatically in order. They can download files, install and launch programs, modify security settings, and plenty more. Email attackers rely on the following script types most often:<\/p>\n
- \n
- .js and .jse<\/li>\n
- .bat<\/li>\n
- .cmd<\/li>\n
- .vbs<\/li>\n
- .wsf<\/li>\n
- .vbe<\/li>\n
- .au3<\/li>\n<\/ul>\n
.js and .jse<\/h3>\n
The .js and .jse extensions are used by JavaScript files. Most users associate JavaScript strictly with websites and don\u2019t realize these files can run locally on their computer as standalone programs.<\/p>\n
We recently wrote about CrystalX RAT, a remote access Trojan<\/a> that logs keystrokes, steals clipboard contents, and injects malicious components into web browsers upon installation. Its JS scripts monitored<\/a> cryptocurrency wallet addresses and silently swapped them with the attacker\u2019s own to hijack transactions in real time.<\/p>\n
.cmd and .bat<\/h3>\n
BAT and CMD files are designed to automate tasks in Windows and can execute virtually any command in the operating system. Launching a file like this can infect your computer with malware.<\/p>\n
.vbs<\/h3>\n
Visual Basic Script files with the .vbs extension are a long-time favorite among cybercriminals. Attackers frequently use double extensions to disguise .vbs files as plain text documents, such as invoices, app installation guides, or emails. For example, in the early 2000s, the iconic ILOVEYOU worm spread via a VBS script, infecting millions of computers worldwide<\/strong><\/a>. Victims received an email with the subject line \u201cILOVEYOU\u201d, but instead of a sweet confession, the attachment contained a malicious script. At its peak, this \u201cromantic\u201d worm had infected up to 10% of all internet-connected computers.<\/p>\n
Web files<\/h2>\n
This category mainly includes .html, .htm, .hta and .svg files. Often these are phishing pages in disguise, designed to mimic login forms for email, cloud services, banking apps, and other platforms. Naturally, any credentials entered on these fake pages go straight to the attackers hunting for your accounts and money. Web files can also trigger malicious scripts and download additional payloads onto your system.<\/p>\n
Archives<\/h2>\n
Cybercriminals routinely package malicious files inside archives (most commonly having .zip, .rar, and .7z extensions). These archives are often password-protected or encrypted to hinder content scanning. Additionally, attackers sometimes create intentionally corrupted archives<\/a> with damaged data structures: basic security filters often stumble over broken files and skip scanning them altogether, whereas archive managers can automatically repair and unpack the contents anyway.<\/p>\n
That\u2019s why we recommend using advanced security solutions<\/a>\u00a0that can spot phishing emails and prevent you from launching dangerous files hidden inside archives.<\/p>\n
PDF files (.pdf)<\/h2>\n
To many, PDF feels like a completely harmless file format\u00a0\u2014 after all, what could go wrong with flight tickets, documents, and slide decks? But beyond static text and images, PDFs can host clickable links, forms, and even scripts.<\/p>\n
Malicious code in a PDF is usually tucked away behind visual elements or embedded as hidden text. What\u2019s more, the risk comes not just from the file itself, but also from the software you use to view it: for instance, attackers spent months exploiting<\/a> a vulnerability in Adobe Acrobat that allowed them to execute malicious PDF files remotely. If you regularly work on PDF documents, make sure the JavaScript feature is disabled in your Adobe Acrobat. To do this, go to Preferences<\/em> \u2192 JavaScript<\/em> in the menu.<\/p>\n
By the way, heavy users of AI agents and chatbots should keep in mind that AI frequently falls for prompt injections<\/a>: hidden commands buried inside images, text, and web pages that the AI interprets as legitimate instructions, and executes without your knowledge.<\/p>\n
LNK shortcuts (.lnk)<\/h2>\n
Files with the .lnk extension are standard Windows shortcuts that we use every day for quick access to apps and folders. By themselves, shortcuts don\u2019t contain any software\u00a0\u2014 they simply tell Windows what file to open or what command to run.<\/p>\n
However, an attacker can give a shortcut any icon and any name they want, completely hiding its real destination. The moment a victim clicks the shortcut, the infection chain kicks off. The malicious code usually executes silently in the background, leaving virtually no visual clues that anything went wrong.<\/p>\n
Cybercriminals also like to hide LNK files behind double extensions<\/a> \u2014 betting that users won\u2019t look close enough to see what kind of file they\u2019re actually opening. Here\u2019s a classic example:<\/p>\n
![\"Attackers](\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2026\/08\/07054636\/dangerous-extensions-in-email-01.jpg\" "\\"Attackers")
<\/a>Windows File Explorer displays only the first part of the extension, .docx. The file type is clearly listed as a shortcut, but very few people notice that detail<\/p><\/div>\n
Your best bet is to avoid clicking incoming LNK files altogether: no one in their right mind has a reason to email you a desktop shortcut.<\/p>\n
By the way, if you haven\u2019t updated Windows in a while, we\u2019ve bad news for you: malicious code can automatically execute<\/a> without you ever clicking the LNK\u00a0\u2014 simply opening the folder where it lives is enough to trigger it. Microsoft finally released a patch<\/a> for this long-abused vulnerability in December 2025. So don\u2019t put off system updates\u00a0\u2014 install them regularly to patch up the security holes attackers rely on.<\/p>\n
Microsoft Office documents<\/h2>\n
.xls and .xlsx<\/h3>\n
The file extension .xls is used by older versions of Microsoft Excel. Millions of people use Excel spreadsheets every day, and many are still running outdated software, which makes XLS files a favorite bait for cybercriminals. Budgets, employee rosters, financial records, urgent reports, and other spreadsheets stop being harmless the moment a user clicks Enable Content<\/em>, allowing the program to run macros\u00a0\u2014 custom Microsoft Office scripts and commands built into the files. Once allowed, the malicious macro gets free rein to download files, launch programs, harvest system data, and alter settings.<\/p>\n
Unlike XLS, XLSX is the modern Excel format, which doesn\u2019t support embedded macros by default. Unfortunately, that doesn\u2019t guarantee complete safety: the spreadsheet can still pull live data from external sources and automatically connect to web destinations in the background.<\/p>\n
.docx<\/h3>\n
Although modern DOCX files don\u2019t support macros by default, attackers have long figured out other ways to weaponize these documents. Typically, malicious DOCX files contain embedded links or instructions that force Word to contact external servers and pull down malicious payloads. Back in 2023, for instance, researchers uncovered a Microsoft Office vulnerability<\/a> that allowed attackers to trigger built-in Windows system tools and download malware straight from the web.<\/p>\n
To reduce your risk when working with Microsoft Office apps, we recommend turning on Protected View<\/a>, blocking external connections<\/a>, and disabling all macros without notification<\/a>.<\/p>\n
Macro support in modern Microsoft Office<\/h3>\n
Macros are sequences of commands that automate complex, repetitive tasks in Excel, Outlook, Word, and PowerPoint. In modern versions of Microsoft Office, documents containing embedded macros are saved in specialized file formats with extensions like .xlsm, .xltm, .xlsb, .docm, and .pptm. While Microsoft Office includes built-in security controls\u00a0\u2014 such as blocking files downloaded from the web<\/a> and warning<\/a> you about potentially dangerous macros\u00a0\u2014 if you don\u2019t actually use macros and have no specific reason to run them, treat files with these extensions with caution.<\/p>\n
How to check if a file is safe<\/h2>\n
- \n
- Use a comprehensive security suite<\/a><\/strong> that automatically scans files for malware, prevents infections, blocks visits to suspicious sites, and completely removes malicious files from your devices. You can take advantage of a 30-day trial of Kaspersky Premium<\/a>\u00a0if you urgently need to disinfect your computer or scan a file for viruses.<\/li>\n
- Never open attachments from unknown senders.<\/strong> Curiosity can cost you dearly, since many malware strains specifically hunt for credit card and crypto wallet data. Let the Mail Anti-Virus<\/a> feature included in our security solutions<\/a> do the heavy lifting: it automatically filters out malicious or suspicious emails and protects you from phishing attacks.<\/li>\n
- Examine incoming emails carefully<\/strong>: cybercriminals have become adept at disguising malicious messages. Always verify email addresses against official ones and make sure you know the signs of phishing<\/a> and spam<\/a>. Attackers might try to scare you with claims of a hacked account, lure you to shady sites with \u201cunbeatable deals\u201d, or urge you to review a work document attached to the email. Any attempt to manipulate your emotions is a major red flag that someone is trying to trick you.<\/li>\n
- Never open files with double extensions. <\/strong>It\u2019s almost always a trap.<\/li>\n
- If you run into a file with an unfamiliar extension, take a moment to look it up online<\/strong>. Remember: a photo or plain text document will never have an .lnk or .vbs extension.<\/li>\n<\/ul>\n
Check out our other posts on email and file security:<\/p>\n
- \n
- Spam 101: what is spam, and how to defeat it<\/a><\/li>\n
- Phishing 101: what to do if you get a phishing email<\/a><\/li>\n
- Attackers disguising phishing as Google AppSheet notifications<\/a><\/li>\n
- Checking QR codes in emails<\/a><\/li>\n
- How to safely convert files<\/a><\/li>\n<\/ul>\n<\/blockquote>\n\n","protected":false},"excerpt":{"rendered":"
Our experts investigated which file extensions cybercriminals use most in their email blasts. Here’s a breakdown of the most dangerous attachment types \u2014 and how to keep your devices safe from malicious files.<\/p>\n","protected":false},"author":2706,"featured_media":56239,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2683],"tags":[19,4146,76,422],"class_list":["post-56238","post","type-post","status-publish","format-standard","has-post-thumbnail","category-threats","tag-email","tag-macros","tag-phishing","tag-threats"],"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/dangerous-extensions-in-email\/56238\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/dangerous-extensions-in-email\/42464\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/dangerous-extensions-in-email\/30929\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com\/blog\/tag\/email\/","name":"email"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/56238","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/2706"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=56238"}],"version-history":[{"count":6,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/56238\/revisions"}],"predecessor-version":[{"id":56241,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/56238\/revisions\/56241"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/56239"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=56238"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=56238"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=56238"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- Phishing 101: what to do if you get a phishing email<\/a><\/li>\n
- Never open attachments from unknown senders.<\/strong> Curiosity can cost you dearly, since many malware strains specifically hunt for credit card and crypto wallet data. Let the Mail Anti-Virus<\/a> feature included in our security solutions<\/a> do the heavy lifting: it automatically filters out malicious or suspicious emails and protects you from phishing attacks.<\/li>\n
- Use a comprehensive security suite<\/a><\/strong> that automatically scans files for malware, prevents infections, blocks visits to suspicious sites, and completely removes malicious files from your devices. You can take advantage of a 30-day trial of Kaspersky Premium<\/a>\u00a0if you urgently need to disinfect your computer or scan a file for viruses.<\/li>\n