Password-protected ZIP attachments: why they're risky and how to handle them

Security tools can't scan what they can't open. A password-protected archive is exactly that: a locked box with the key taped to the outside, in the email body, where only a person will use it. That's why encrypted ZIP, 7z and RAR attachments turn up so often in malware campaigns. This guide explains the risk, how containers interact with Windows protections, and how to quarantine encrypted attachments in Microsoft 365 and Google Workspace. For the full list of risky file types, see dangerous email attachment types.

Why do attackers send password-protected ZIP files?

To get past the scanner. MITRE ATT&CK describes spearphishing attachments that include "instructions on how to decrypt an attachment, such as a zip file password," in order "to evade email boundary defenses."

The encryption doesn't protect anything from the attacker's point of view. It protects the payload from your filters. The email gives the person the password, often with a plausible reason:

• "The invoice is encrypted for your security. Password: 4471."
• "Confidential HR document. Use your employee ID to open."
• "Secure statement attached. Password in the next email."

Real-world examples in MITRE's Encrypted/Encoded File technique (T1027.013) include droppers "delivered as password-protected zip files" and password-protected malicious Word documents.

What can a scanner see?

Some scanners try a password found in the email body. MITRE notes that "some email scanning devices can open and analyze compressed and encrypted formats." Don't assume yours does. Ask, and test it.

What file types are involved?

Encryption isn't limited to ZIP files. Common formats in these attacks:

• ZIP, which Windows opens natively, so it needs no extra software.
• 7z and RAR, which need an archive tool but support stronger encryption and can hide file names.
• Encrypted Office documents and PDFs, which open in familiar apps after a password prompt.
• Disk images (.iso, .img, .vhd, .vhdx), which aren't encrypted but are containers with similar effects on Windows protections.

What's inside is usually something that runs code: a script, a shortcut (.lnk), an executable, an HTML file or a macro-enabled document.

What does an encrypted-archive lure look like?

The email around the archive does most of the work. Watch for these patterns:

• A short message with a password and little else. "Please see attached. Password: 7721." Genuine senders usually explain what the file is and why it's protected.
• Urgency tied to money or HR. Overdue invoices, payment confirmations, salary reviews, disciplinary notices and tax documents.
• A reply in an existing thread. Attackers who steal old conversations insert an encrypted attachment into a real thread, so the sender name and subject look familiar. Our guide to email thread hijacking explains the pattern.
• A mismatch between name and contents. A file called Invoice_0923.zip that contains a script, a shortcut or an HTML file instead of a PDF.
• Password in a second email. Some campaigns send the password separately to look more professional. It doesn't make the attachment safer.

None of these proves an attack on its own. Together with an encrypted attachment you weren't expecting, they're enough to stop and check.

How do archives and disk images bypass Mark of the Web?

Mark of the Web (MOTW) is a tag Windows adds to files from the internet, such as browser downloads and email attachments (Microsoft Learn). Office uses it to block macros in internet files, and other Windows security checks also look for it.

Containers can break that chain. MITRE ATT&CK T1553.005 explains that "container files downloaded from the Internet will be marked with MOTW but the files within may not inherit the MOTW" after extraction or mounting, because "MOTW is a NTFS feature and many container files do not support NTFS alternative data streams." Once extracted or mounted, the files "may be treated as local files."

Microsoft's Q1 2026 email threat report says plainly: "Threat actors commonly use ZIP files to circumvent Mark of the Web (MOTW) protections."

Whether MOTW carries through depends on the Windows version, the tool used to extract the archive and its settings. You don't control which tool a user picks, so treat the gateway as the place to stop containers. MITRE's suggested mitigations are to "consider blocking container file types at web and/or email gateways" and to consider disabling auto-mounting of disk image files. Our guide to Office macros blocked from the internet explains how MOTW drives macro blocking.

How do you quarantine encrypted attachments in Microsoft 365?

Microsoft's common attachments filter blocks by file type, but a ZIP is a ZIP whether or not it's encrypted. To act on encryption, use a mail flow rule. At the time of writing (October 2026), Exchange Online offers these attachment conditions (Microsoft Learn):

Note the detection list: .rar isn't named for password detection, so add a second rule that matches the .rar file extension if you want RAR attachments held too. Microsoft also says all these attachment conditions scan compressed archive attachments.

A practical rule:

1. In the Exchange admin center, go to Mail flow > Rules and create a rule.
2. Apply this rule if: The sender is located Outside the organization, and Any attachment is password protected.
3. Do the following: Redirect the message to hosted quarantine.
4. Except if: the sender's domain is one of a short list of partners who genuinely send encrypted files.
5. Set the mode to test first, review what it catches for a week, then enforce.

Our guide to mail flow rules for security covers rule ordering and testing.

How do you quarantine encrypted attachments in Google Workspace?

In the Google Admin console, go to Menu > Apps > Google Workspace > Gmail > Safety, then scroll to Attachments (Google Workspace Admin Help). The setting is Protect against encrypted attachments from untrusted senders, described as protection "against attackers who use encrypted attachments, which can't be scanned for malware."

The default action is Keep email in inbox and show warning. Change it to Quarantine or Move email to spam if you want the message held rather than delivered with a banner. Our guide to Google Workspace advanced phishing and malware protection covers the neighboring settings for scripts and unusual attachment types.

Should you block or quarantine encrypted archives?

Quarantine is usually right. Some businesses do receive encrypted files legitimately: payroll exports, legal documents, medical records, accountants' year-end packs. A block bounces those; a quarantine holds them for a quick check.

A release checklist

Before releasing an encrypted attachment from quarantine:

1. Was the recipient expecting a file from this sender?
2. Does the sender's address match previous genuine mail, letter by letter? See lookalike domain phishing.
3. Did the sender confirm through another channel, such as a phone number you already had?
4. Is the password in the same email? Legitimate senders often send it separately or agree on it in advance.
5. After release, does the archive contain the file type you expected? A "PDF invoice" archive containing a .js, .lnk or .exe file is an attack.

How should staff handle encrypted attachments?

Give people a simple rule: an encrypted attachment you weren't expecting is suspicious, especially when the password is in the same email.

• Don't open it. Report it through your normal button or address. See how to report phishing.
• If you expected it, confirm with the sender by phone before opening.
• After opening, if the archive contains anything other than the document you expected, close it and tell IT.
• If you already ran something from inside an archive, follow what to do after clicking a phishing link and contact IT straight away.

For files you send, stop using encrypted ZIPs with the password in the email. A shared link with named-user access or your platform's message encryption protects the content better. Our guide to email encryption types compares the options.

Next steps

• Check what your filter does today with a password-protected ZIP: send a harmless test file from an outside account and see where it lands.
• In Microsoft 365, add a mail flow rule for Any attachment is password protected. In Google Workspace, change the encrypted attachment action to quarantine.
• Block disk image attachments outright.
• Write down who can release quarantined encrypted files and what they must check first.
• iBlockSpam includes attachment-type filters and a personal quarantine for every user, with scheduled digests. See quarantine and digests.

Browse our other phishing and threat guides.