Which email attachment types are dangerous, and what should you block?

Most malware still arrives as an attachment that someone opens. The good news is that the riskiest file types are rarely needed in business email, so you can stop them before anyone has to make a judgment call. This guide sorts attachment types into block, quarantine and allow, based on Microsoft's defaults and CISA's guidance.

Which email attachment types are dangerous?

An attachment is dangerous when opening it can run code, or when it leads straight to a fake sign-in page. These groups cover nearly all of it:

The block list is the easy part. Ask yourself one question per type: does anyone outside the company ever need to email us this? For executables, scripts, shortcuts and disk images, the answer is almost always no. Software arrives through vendor portals and app stores, not inboxes.

What's in Microsoft's common attachments filter?

Microsoft 365 anti-malware policies include a common attachments filter. Microsoft's reasoning is simple: some file types aren't suited to email, so rather than scanning them, block them all. Its default list has 53 types:

ace, ani, apk, app, appx, arj, bat, cab, cmd, com, deb, dex, dll, docm, elf, exe, hta, img, iso, jar, jnlp, kext, lha, lib, library, lnk, lzh, macho, msc, msi, msix, msp, mst, pif, ppa, ppam, reg, rev, scf, scr, sct, sys, uif, vb, vbe, vbs, vxd, wsc, wsf, wsh, xll, xz, z

Three details are worth knowing:

1. The default action is reject with an NDR. You can change it to quarantine. Because the block comes from an admin policy, these messages don't get a malware verdict.
2. It's not on everywhere. Microsoft's recommended settings say the filter is on by default in new policies and in the default policy of organizations created after December 1, 2023. Older tenants should check.
3. It checks the real file type. Microsoft uses best-effort true type matching, so an .exe renamed to .txt is still caught. Where true type detection isn't supported, it falls back to the extension.

Notice what the default list leaves out: .js, .ps1, .vhd, .html, .one and .zip aren't on it, though most can be added from the extra types in the Defender portal. .svg isn't on the extra list either, so filtering it needs a custom entry or another layer.

Outlook keeps its own, longer list of blocked attachments that the client won't open. It includes .js, .ps1, .vhd, .vhdx, .url and .cpl. That protects Outlook users, but not people reading mail in other apps, so don't rely on it alone.

What does CISA recommend?

In its October 2023 joint phishing guidance with the NSA, FBI and MS-ISAC, CISA recommends denylists at the email gateway. These should block "file extensions such as .scr, .exe, .pif, and .cpl and mislabeled file extensions", giving the example of an .exe labeled as a .doc. The same guidance says to block macros by default.

Two lessons follow. Block by real type, not just by name. And treat attachment filtering as one layer: the guidance pairs it with application allowlisting, DMARC and user reporting.

Why are HTML and SVG attachments risky?

HTML and SVG files are plain text, so they look harmless to simple scanners.

HTML smuggling. Microsoft described the technique in 2021: an HTML attachment carries an encoded script, and the browser decodes it and assembles the malicious file on the user's device. Gateways may see only "benign HTML and JavaScript traffic", because the payload doesn't exist until the page opens.

Credential phishing. An HTML attachment can be a complete fake sign-in page that runs locally, with no suspicious link in the email body. In its Q1 2026 email threat report, Microsoft said HTML attachments started the quarter as the leading malicious file type, at 37% of payloads in January.

SVG files. SVG is an image format, but Microsoft notes SVGs "are text-based and scriptable." In one 2025 campaign, the attachment was named 23mb – PDF- 6 pages.svg to look like a PDF and led to a fake sign-in flow. Few businesses need to receive SVG attachments; quarantine them.

Why are disk images and archives used?

Disk images (.iso, .img, .vhd) and archives wrap other files, which can hide an executable from a filter that only checks the outer name. Containers also matter because of Mark of the Web (MOTW), the tag Windows adds to files from the internet. Office uses it to decide whether to block macros. Microsoft's Q1 2026 report notes that threat actors commonly use ZIP files to circumvent MOTW protections.

Microsoft's default filter list already includes .iso and .img. Add .vhd and .vhdx unless you have a reason not to. For ordinary archives, use a filter that opens them and applies your rules to every file inside.

Password-protected archives are a special case. The password sits in the email body, so the person can open the file, but your scanner can't. Quarantine them by default and release only those the recipient was expecting from a known sender.

Do macro-enabled Office files still matter?

Less than before, but yes. Microsoft changed Office to block VBA macros in files from the internet by default. It reached Current Channel in July 2022 and Semi-Annual Enterprise Channel in January 2023 for Word, Excel, PowerPoint, Access and Visio.

That protection has limits:

• It only applies to Office on Windows.
• It depends on Mark of the Web being present on the file.
• Users can still remove MOTW by selecting Unblock in the file's properties.
• Older or unmanaged Office installs may behave differently.

So keep a gateway rule too. Block macro-enabled formats if nobody uses them, or quarantine them if some teams do.

What about OneNote files?

A OneNote notebook can embed other files, including scripts and executables. Users used to be able to open them after a single warning. Since Version 2304 in 2023, OneNote for Microsoft 365 on Windows blocks opening embedded files with dangerous extensions, using the same list as Outlook. It doesn't apply to OneNote on Mac, mobile, the web or OneNote for Windows 10. Few businesses exchange .one files by email; quarantine them.

How to decide: block or quarantine?

Block (reject, so the sender gets an NDR) when a file type has essentially no legitimate business use by email. Rejecting tells a genuine sender immediately that they need another route.

Quarantine when a type is often abused but sometimes legitimate. The message is held, the recipient can see it was stopped, and an admin can release it after checking. Personal quarantine digests keep this manageable for users.

Allow and scan everyday formats such as PDF, Office documents without macros, and images. Content scanning and link checks do the work here.

A setup checklist

1. List the file types your business really receives. Ask finance, sales and operations.
2. Turn on your gateway's or Microsoft 365's attachment-type filter, and confirm it checks true file type.
3. Block executables, scripts, shortcuts, .xll and disk images.
4. Quarantine macro-enabled Office files, HTML, SVG, .one and encrypted archives.
5. Make sure archives are opened and their contents checked against the same rules.
6. Write down how a user asks for a release, and who approves it.
7. Tell staff that blocked file types exist, and how to receive a file another way, such as a shared link.
8. Review quarantine releases monthly. If you release the same type from the same partner every week, agree a safer exchange method with them.

Next steps

• Check your current setup: open your attachment filter policy, confirm it's on and what action it takes, and review recent rejections and quarantines for blocked types.
• Read what is email quarantine to plan how releases will work.
• If someone already opened a suspicious attachment, follow what to do after clicking a phishing link.
• If you use Microsoft 365, pair this with stopping phishing emails in Microsoft 365.
• iBlockSpam includes attachment-type filters and a Microsoft Office macro filter, with personal quarantines for every user. See how it works.

Browse our other phishing and threat guides.