Suspicious email attachment: check the file before you open it

1. 1

   Already opened it? Disconnect and scan

   On a work device, call your IT team first and follow their instructions. On your own device: disconnect it from the internet, run a full antivirus scan and change your passwords from another device.
2. 2

   Otherwise, leave it closed

   Don’t open it, and don’t forward it to someone else to open.
3. 3

   Ask the sender another way

   Call or message them using a number or address you already had, not the one in the email. If they sent nothing, report the email, then delete it.
4. 4

   Look at what the file really is

   Programs and scripts (.exe, .js, .vbs, .bat, .scr), shortcuts (.lnk) and disk images (.iso) are not documents: Outlook blocks them as attachments because they can carry viruses. In a .zip archive, they still get through. A name such as invoice.pdf.exe is a program, not a PDF.
5. 5

   Never enable content or macros to read it

   If a document opens with a banner asking you to enable content or macros, close it: enabling them is what lets its code run.
6. 6

   For a second opinion, check its hash

   Save the file without opening it and compute its SHA-256 with Get-FileHash in PowerShell on Windows, shasum -a 256 in Terminal on a Mac, or sha256sum on Linux, followed by the file’s path. Paste the result into the file hash lookup below.
7. 7

   Report the email

   Send it to the services below, then delete it.

isMalicious compares what you paste with the threat intelligence sources it collects. It does not scan your device and cannot undo what already happened.

• Malware file hash database: the malware samples with enough threat intelligence for a report.

Keep the message, the link or the number until you have reported it: you will need them. These are the services that handle each case.

Somewhere else? Report to your national police or your country’s cybercrime reporting service.

In France? The French version of this guide lists the French services.

• You weren’t expecting it, even if it comes from someone you know: their account may have been hacked.
• You expected a document and received an archive (.zip) or a disk image (.iso).
• The document says it can only be displayed once you enable content or macros.
• The file name has two extensions, such as invoice.pdf.exe.

• I clicked a phishing link: what to do now

  Close the page, then deal with what you typed, downloaded or allowed after the click.

• Fake invoice or changed bank details: what to do before you pay

  Call the supplier on a number you already had before paying any new bank details.

• Tech support scam pop-up: what to do now

  Don’t call the number: close the page, and if you already called, cut the remote access.

The steps follow these official pages, read on 2026-10-02:

• MicrosoftBlocked attachments in Outlook (opens in a new tab)
• MicrosoftMacros from the internet are blocked by default in Office (opens in a new tab)
• MicrosoftGet-FileHash (opens in a new tab)
• NCSCPhishing scams: if you’ve shared sensitive information (opens in a new tab)
• FTCMalware: How To Protect Against, Detect, and Remove It (opens in a new tab)
• Cybermalveillance.gouv.frPiratage d’un système informatique de particulier, que faire ? (opens in a new tab) (in French)