#10DaysAgainstPhishing: How to handle suspicious email attachments?

Summary

Why is this warning issued?

This warning was included because it is based on a report from Watchlist Internet. It is intended to protect other users from this scam. The assessed risk is elevated.

How the scam works

• An email with disturbing or curiosity-inducing content unexpectedly lands in your inbox.
• The criminals use fake identities, e.g. police, law office, or a private person with a job application.
• You are asked to open an attachment – or to click a download link in the email.
• When opening the attachment or the downloaded file, malware is installed on your device without your notice.
• The malware can infect your device, spy on data, or steal passwords.

How to recognise it

• You unexpectedly receive an email with an attachment you did not request.
• The content is disturbing (e.g. alleged summons, criminal proceedings, indictment) or extremely curiosity-inducing.
• You are pressured to quickly open the attachment or click a link.
• The email supposedly comes from the police, a law office, or a private person with a job application.
• The topics include copyright infringements, unpaid invoices, or a court date.
• The email text contains a download link through which you are supposed to download a file.
• Impersonal greeting and time pressure
• Link to an external login page

How to protect yourself

• Do not open attachments and do not click download links in unexpected or suspicious emails.
• Check suspicious files with virustotal.com: only download the file (do not open it!), then upload it to virustotal.com and review the report.
• If virustotal.com raises an alert: delete the file from the Downloads folder and the Trash immediately, delete the email, block the sender.
• Always keep your operating system and security software up to date.
• If you have already opened an attachment: run an immediate virus scan with multiple programs, wait a few days, and scan again. Then change all important passwords (e.g. online banking, email, social media) and file a report with the police.
• If in doubt, contact IT experts to have your device checked.

What you should never do

• Do not open attachments in unexpected emails, even if the sender appears legitimate.
• Do not click download links in suspicious emails.
• Do not ignore the problem if you have already opened an attachment – act immediately.
• Do not rely on just a single antivirus program when checking your device for a possible infection.
• Do not open a suspicious file directly at your workplace before you have checked it – this also puts your company at risk.

Frequently asked questions

Affected data

Comments

Related warnings

• Betrug in zwei Akten: Die nächste Runde im Klimabonus-Phishing
• Pensionsleistung genehmigt: 723-Euro-Versprechen ist Phishing
• #10TageGegenPhishing: Niemals klicken! Immer selbst einloggen!
• #10TageGegenPhishing: KI-gestützte Betrugsversuche erkennen
• #10TageGegenPhishing: Quishing – Wenn QR-Codes zur Betrugsfalle werden
• #10TageGegenPhishing: Warum Phishing-Fallen immer mit Druck arbeiten

Original source

Update history

• 11/10/2026Description updated
• 10/10/2026Warning added from an official source