Malware
Updated
Malware is software designed to perform harmful or unauthorized actions. Email can deliver it directly as an attachment or indirectly through a link, download, or deceptive installation request. Malware includes different capabilities, such as credential theft, remote access, or ransomware; identifying the family is only one part of assessing an incident.
What do I need to know about Malware?
- A document, archive, or familiar-looking file extension is not proof that a file is safe.
- Some malicious content needs a user action; other attacks exploit software weaknesses. Keep the interaction history precise.
- A scan result is time- and context-dependent. Newly encountered threats or protected file contents may limit inspection.
- Removing the email does not undo a program that already ran or access that was already stolen.
An illustrative example
A “resume” email links to a cloud-hosted archive that asks the recruiter to install software. The cloud brand makes delivery plausible but does not validate the payload. If the file ran, the investigation expands from the message to the endpoint, accounts used on it, and related recipients.
Practical checks
- Preserve the message and file identifiers using approved incident tools; do not forward a live payload casually.
- Establish whether the file was downloaded, opened, or executed, and escalate suspected execution to endpoint responders.
- Search for other recipients and related indicators, then verify containment across email and affected devices.
Five FAQs about Malware
Is every attachment dangerous?
No. Attachments are routine business tools. Risk depends on provenance, behavior, file type, context, and controls. Unexpected requests to enable features or install software deserve particular attention.
Can malware arrive through a trusted file-sharing service?
Yes. A service can host or deliver attacker-controlled content. Evaluate the file and request rather than assuming the hosting brand makes it trustworthy.
Does deleting the message remove malware?
Not if software has already executed or established access. Email containment and endpoint remediation are different tasks.
What should I do if I opened a suspicious attachment?
Report promptly and describe exactly what happened, including prompts accepted and programs installed. Follow your organization’s instructions for the device; avoid experimenting with the file again.
Can a clean scan guarantee safety?
No. A scan is one piece of evidence with limits. Combine it with context, other detections, and observed behavior, especially when the message requests an unusual action.
Sources and further reading
Microsoft: Email anti-malware protection · MITRE ATT&CK: Spearphishing attachments for information
