The Hidden Dangers of Email Attachments
Have you ever opened an email attachment without thinking twice? Files labeled “Invoice”, “Report”, or “Meeting materials” may look routine — but some are cleverly disguised traps that can cause system failures or data breaches. This post highlights two common threats in corporate environments: ZIP bombs and macro viruses.
ZIP Bombs: When Unzipping Crashes Your System
A zip bomb is a maliciously compressed file that expands into gigabytes, or even terabytes, of data when extracted. This overloads your PC or antivirus software, potentially causing a system freeze or crash.
What to watch for:
- Suspiciously small ZIP files (e.g., just a few KB)
- Generic names like “Invoice.zip”, “Report.zip”
- Unexpected behavior after extraction (e.g., freezing, antivirus shutdown)
Note
What to do:
- Never unzip files from unknown senders
- Check file properties before extracting (right-click → Properties)
- Keep real-time protection enabled in your antivirus software
Macro Viruses: Hidden Code in Office Documents
Macro viruses are embedded in Word or Excel files and activate when the document is opened — especially if you click “Enable Content”. These scripts can perform unauthorized actions like sending data externally or modifying files.
What to watch for:
- File extensions like “.docm” or “.xlsm” (macro-enabled formats)
- Prompts to “Enable Content” upon opening
- Unexpected behavior after enabling macros
Note
What to do:
- Avoid clicking “Enable Content” unless you trust the sender
- Only open macro-enabled files sent internally by someone you trust
- Set Office to “Disable VBA macros with notification” in your settings (File → Options → Trust Center → Trust Center Settings → Macro Settings)
How Microsoft 365 helps
Since most of us work in Microsoft 365, it helps to know that Outlook and Exchange Online already screen attachments for you. Exchange Online Protection (EOP) scans every incoming attachment for known malware and automatically blocks risky executable file types, and Zero-hour Auto Purge (ZAP) can pull a malicious message out of your mailbox even after it has been delivered. If your organization has Microsoft Defender for Office 365 (included with Business Premium and E5), Safe Attachments goes a step further and opens unknown files in an isolated sandbox to check how they behave before they ever reach you. Modern Office apps also block VBA macros in files that come from the internet by default. These layers stop a great deal — but they are not a guarantee, so the habits above still matter.
Share and Report
Attachment-based attacks don’t just affect individuals – they can compromise entire departments. Early detection and communication are key.
- If something feels off, consult your IT team before opening
- If you’ve already opened a suspicious file, report it immediately
- Share alerts with colleagues — similar emails may be circulating
Think Before You Click
Attachments are useful, but they come with risks. Before opening any file, ask yourself: “Who sent this?”, “What format is it?”, “Do I really need to open it?”
Caution
A moment of caution can protect your data and your team. When in doubt, check with your IT team before opening.