Malicious Attachment
Phishing emails contain file attachments designed to install malware, harvest credentials, or deceive users into taking harmful actions. These attachments often masquerade as legitimate documents, invoices, or updates, leveraging trust and urgency to increase the likelihood of interaction.
Mapped to
MITRE ATT&CK®
Sub-techniques
TE0005.1
Executables
Malicious .exe files masquerade as legitimate software, documents, or installers. When executed, they deploy malware such as keyloggers, remote access Trojans (RATs), or ransomware.
TE0005.2
HTML-Files
HTML files embedded within emails redirect victims to phishing websites that mimic legitimate login pages, capturing credentials or delivering malicious scripts upon opening.
TE0005.3
PDF-Files
PDFs containing phishing links or JavaScript-based exploits that execute automatically when opened. These may impersonate invoices, government forms, or shipping confirmation.
TE0005.4
Disk Image
Disk images (.iso, .img, .vhd) are used to package malware in a format that can bypass email security filters. When mounted, they contain malicious executables disguised as system files.
TE0005.5
Office Files
Microsoft Office files (.docx, .xlsm, .pptm) contain malicious macros that execute scripts when enabled. Attackers often use social engineering prompts to convince users to enable macros, triggering payload delivery.
TE0005.6
EML-Files
Attackers send .eml files as attachments, containing pre-crafted phishing emails that bypass security filters. These standalone emails often include malicious links or attachments, tricking victims into opening them without the usual sender authentication checks.
TE0005.7
Compressed Files
Archive files (.zip, .rar, .7z) conceal malware payloads to evade detection. These archives often contain executable files disguised with double extensions (e.g., invoice.pdf.exe)
TE0005.8
Text-Based Files
Plain text files (.txt, .log) appear harmless but contain phishing links, misleading instructions, or obfuscated scripts meant to deceive users into copying and executing malicious commands.
TE0005.9
Image Files
Image files (.jpg, .png, .gif) are embedded with phishing messages, malicious QR codes, or steganographic data that conceals links or scripts.
TE0005.10
Calendar Files
Malicious calendar files such as .ics are used to deliver phishing links or trigger social engineering events by automatically adding deceptive events to a user's calendar. These events may contain links to malicious websites or prompt users to join fraudulent meetings, exploiting trust in calendar notifications and integration with email clients.