# Are e-mail attachments still dangerous?

Yes, though the dangerous types have shifted. Since 2022, Microsoft Office blocks macros by default in files downloaded from the internet, which closed the old route of the infected Word document for most companies. Attackers moved to other formats: compressed archives with a password given in the message text, disk image files, shortcut files, HTML attachments that build a fake login page or download a file when opened, and PDFs that contain only a link or a QR code. A rule of thumb for staff: an unexpected attachment that asks you to enable content, enter a password, scan a code or open another file is a reason to stop and ask. For IT: block uncommon attachment types at the mail gateway, keep the macro block in place, and make sure endpoint protection inspects files opened from archives. If someone opened something suspicious, follow the same steps as after a phishing click.

FAQ: [Phishing and e-mail aftermath](https://netsenx.com/en/faq/phishing) · https://netsenx.com/en/faq/are-email-attachments-still-dangerous

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/what-is-ndr

## Related questions

- [What does NetSenX see after someone clicks a phishing link?](https://netsenx.com/en/faq/what-does-netsenx-see-after-a-phishing-click)
- [What is phishing?](https://netsenx.com/en/faq/what-is-phishing)
- [How can you tell that an e-mail is phishing?](https://netsenx.com/en/faq/how-to-spot-a-phishing-email)
- [I clicked a phishing link. What should I do now?](https://netsenx.com/en/faq/i-clicked-a-phishing-link-what-now)
- [I entered my work password on a phishing page. What now?](https://netsenx.com/en/faq/i-entered-my-work-password-on-a-phishing-page)