Guide: How to Safely Open an Email Attachment

Why This Guide Exists

Most malware infections start with the user opening a file. The good news is that a few minutes of caution will eliminate the overwhelming majority of risk. Here is a concrete, repeatable process.

Step 1 — Pause Before You Click

If the email is unexpected, urgent, or from someone you do not usually receive attachments from, stop. Do not double-click yet.

Ask yourself:

Did I ask for this file?
Does the file type make sense for the supposed content?
Is the sender's email address actually what it appears?

Step 2 — Verify the Sender

In the email client, hover over the sender's name to reveal the actual address. Look for:

Lookalike domains — apple-support.com instead of apple.com.
Display name spoofing — the friendly name says "CEO" but the address is gmail.
A reply-to address that differs from the from address.

If anything feels off, verify through a separate channel — phone, Slack, a known good email thread. Do not reply to the suspicious email itself.

Step 3 — Check the Extension

Enable file extensions in your operating system if they are hidden. Then look at the full filename:

.exe, .scr, .bat, .cmd, .ps1, .vbs → executable, treat with extreme caution.
.docm, .xlsm, .pptm → contains macros, can run code.
.zip, .rar, .7z, especially password-protected → favourite delivery format for malware.
.iso, .img, .vhd → disk images that bypass many email scanners.

Step 4 — Scan Before Opening

Do not open the file on your main device yet. Instead:

Save it to a folder without executing it.
Upload it to an antivirus scanner such as Virus Purge.
Wait for the verdict.

If the file is flagged, delete it immediately. If it is clean, continue.

Step 5 — Open in a Safe Environment

Even a clean scan is not a guarantee — zero-day malware exists. For files from untrusted sources:

Open Office documents in Protected View (the default if downloaded from the internet). Do not enable editing or macros unless absolutely necessary.
Open PDFs in a sandboxed reader (modern browsers, or dedicated viewers in protected mode).
Open archives in a viewer rather than extracting them. Inspect contents first.
For genuinely suspicious files you must examine, use a disposable virtual machine or a service like Any.run.

Step 6 — Watch for Post-Open Signs

After opening, watch for:

Unexpected prompts to "enable content" or "allow access".
The application crashing immediately.
New processes appearing in Task Manager / Activity Monitor.
Sudden CPU or network activity from the application.

If you see any of these, disconnect from the network and run a full antivirus scan.

Quick Reference Checklist

Print this and pin it next to your monitor.

[ ] Expected sender?
[ ] Sender address matches display name?
[ ] Reply-to consistent?
[ ] File extension makes sense?
[ ] Scanned with antivirus and got a clean verdict?
[ ] Opened in Protected View / sandbox?
[ ] No suspicious behaviour after opening?

Six checks. Less than a minute. Saves weeks of recovery.