2.3Trapped links & attachments
The essentials in 30 seconds
- One click can trigger everything: trapped link or attachment = ransomware's entry point — only open what you expected.
- Extensions always shown: the double extension is unmasked — seeing the extension means seeing the danger.
- “Enable macros” = red alert: it triggers the malware — refuse and report.
Threaded mini-case — Karim and the “invoice” with a double extension
Karim receives from a known contact an email with a “invoice.pdf” attachment he was not expecting, plus a document asking to “enable content”. His extensions are shown: the file is actually a trapped double extension. He opens nothing and calls the sender on their known number: their account was hacked, they never sent anything. Karim reports to IT instead of “enabling”.
Teaching model: the quoted file names illustrate the signs to spot, without providing any malicious content.
1. One click can trigger everything
One click on a trapped link or opening a malicious attachment can be enough to infect the workstation, even the whole network (ransomware). Risky extensions: pure executables, but also archives hiding them and macro-enabled Office documents. An unexpected attachment is not opened — even “from” a known contact, whose account may be hacked.
2. Macros and double extensions
A received Office document's “Enable content” launches the malware — Office blocks it by default, don't unblock it. The double extension fools the eye: the system may hide the second one — always show file extensions (Explorer → View). Like Karim: seeing the extension means seeing the danger.
3. Links and QR codes
Hover over a link to see the real URL before any click. The trapped QR code (quishing) is a link you cannot hover: same suspicion rules, especially in public spaces. In doubt about a file: don't open it, ask IT — and for exchanges, prefer the company's approved tools over attachments.
🔎 Concrete example — 🔎 Concrete example — Setting up your workstation to see danger
What Karim set up and applied (standard system settings):
Explorer → View → tick “File name extensions”.
Office document asking to “enable macros” → refuse + report.
Doubt about a file → do not open, ask IT.Takeaway: double extensions and macros lose their camouflage.
Lesson: unexpected = don't open.
Section vocabulary
- Trapped attachment
- File executing malicious code on opening: ransomware massively enters this way.
Simple example: The fake “invoice” Karim received, which he was not expecting.
What it is not: an expected, consistent document sent via the company's approved tool.
Reflex: unexpected = don't open, verify via another channel.
- Risky extensions
- Pure executables and formats hiding them (archives) or triggering code (macro-enabled Office documents).
Simple example: A double-extension file hiding its true nature.
What it is not: an ordinary office document expected in a consistent context.
Reflex: always show extensions to judge with full facts.
- Malicious macro
- A received Office document's “Enable content”: the click launching the malware — blocked by default, never to unblock.
Simple example: The banner of Karim's received document asking to enable content.
What it is not: a macro from an internal template approved by the company's IT.
Reflex: macro banner on a received document = refuse + report.
- Double extension
- File name with two extensions, the second of which the system may hide, revealing the file's true nature.
Simple example: An “invoice” shown as PDF but actually an executable.
What it is not: a real single-extension PDF invoice in an expected context.
Reflex: extensions shown permanently on the workstation.
- Trapped QR code (quishing)
- A QR code is a link you cannot hover: same suspicion rules, especially stuck up in public spaces.
Simple example: A QR code stuck over an official notice leading to a fake page.
What it is not: a QR code shown by its own service's official app.
Reflex: unexpected QR code = same reflexes as for a link.
In practice — In practice — Setting up your workstation to see danger
- Show extensions: Windows Explorer → View → tick “File name extensions” — essential to spot double extensions.
- Examine the last 5 attachments received: exact extension? expected sender? consistent context?
- Rule for received Office documents: if a banner asks to “enable macros/content” → refuse and report, unless the sender explicitly confirmed via another channel.
- In doubt about a file: don't open it, ask IT — some analysis tools (sandbox) do this very well.
Ready-to-say script — checking an unexpected attachment (20 s)
“Hello, I just received a file from you that I was not expecting. Before opening it, can you confirm by phone that you really sent it to me, and what it is? Meanwhile, I won't open it.”
Say to the supposed sender via a different channel (phone, internal chat) — never by replying to the suspicious message.
Copy-paste template — attachment check
FILE RECEIVED ON: _______________
EXACT EXTENSION (shown): _______________
EXPECTED SENDER? YES / NO — CONSISTENT CONTEXT? YES / NO
MACROS REQUESTED? YES → REFUSE + REPORT / NO
DECISION: open (expected + consistent) OR verify via another channel → report to ITSmall business / tight budget
Shown extensions + systematic macro refusal: two free settings blocking most of it.
SME in Algeria
Karim uses the company's approved tools for external exchanges instead of attachments.
Large company / sandbox
Dubious file sent to IT for isolated analysis rather than opened on the workstation.
Mobile / QR codes
Public QR code: check the displayed URL before opening, and go through the official app.
✓ Best practices
- Always show file extensions.
- Refuse “Enable macros” on a received document.
- Don't open an unexpected attachment, even from a known contact.
✗ Common pitfalls
- Enabling macros of a received Office document.
- Opening a double-extension file without checking.
- Scanning a public QR code without suspicion (quishing).
Key takeaways
- An unexpected attachment is not opened — even “from” a known contact (their account may be hacked).
- Extensions always shown: the double extension is a classic.
- “Enable macros” on a received document = red alert: it triggers the malware.
- A QR code is a blind link: same reflexes as for a link, extra caution.
48h Challenge - apply tomorrow
Enable extension display on your workstation and audit your last 5 attachments (exact extension, expected sender, context). Report any dubious file to your contact.
- I can explain the double extension to a colleague.
- I know why “enabling macros” is forbidden on a received document.
- I showed extensions and audited 5 attachments.
Frequently asked questions
Can a PDF be dangerous?
Yes, though more rarely than executables and macros: some PDFs exploit unpatched reader flaws or contain phishing links. Up-to-date reader + suspicion about origin stay in order.
How to send/receive files safely then?
Via the company's approved tools (SharePoint, controlled-access OneDrive links) rather than as attachments — and for sensitive external exchanges, the secure exchange platforms provided by IT.
Karim receives an Office document asking to “enable macros”. What does he do?