Email Malware: Types, Delivery Methods and Protection Guide

Email malware is malicious software delivered through email via infected attachments, malicious links, or embedded code that infects a device or network when a recipient opens a file, clicks a link, or previews a message in a vulnerable email client. Verizon DBIR consistently identifies email as the primary malware delivery channel. Symantec reports one in every 412 emails contains malware, equating to billions of malware-laden emails every day.

If your email security blocks .exe files and you consider your malware exposure managed, the current threat picture is more complex. Attackers shifted away from executable attachments years ago precisely because widespread blocking made them ineffective. Today ransomware and trojans arrive inside Word documents, encrypted archive files, and disk image files that most email gateways allow without question. Effective email malware protection now requires understanding which delivery methods your current controls actually address and which ones they miss.

What Is Email Malware?

Email malware is any malicious software that uses email as its initial delivery mechanism to infect a recipient’s device or network. Infection occurs when a recipient opens an attachment, clicks a link, or in some cases previews a message in a vulnerable email client that renders active content.

Email is the most effective malware delivery channel for one straightforward reason: it benefits from inherent trust. Employees expect attachments and links from colleagues, suppliers, and service providers. The volume of legitimate email makes individual scrutiny difficult to maintain consistently. Attackers exploit the gap between expected email behavior and suspicious email behavior by making malicious emails look like routine business communications.

The shift in delivery methods is important context. Early email malware relied on executable attachments. Modern email malware uses weaponised documents, malicious URLs, steganography, and fileless techniques specifically to evade the defenses built to stop the previous generation of attacks.

For a full overview of how email security tools address these threats, see The Complete Guide to Email Security and Types of Email Security: A Complete Breakdown.

What Are the Most Common Types of Email Malware?

Email-delivered malware covers distinct categories, each with different objectives and business impact. Ransomware causes the most direct financial damage. Trojans create persistent access. Rootkits are the hardest to remove once installed.

Modern ransomware uses double extortion: data is stolen before files are encrypted, creating payment pressure even when backups are available.

How Is Malware Delivered Through Email?

Email malware reaches targets through four main delivery mechanisms. Understanding each one also requires understanding why attackers switched between them as email security controls evolved.

• Malicious attachments: files that execute malware when opened, using social engineering pretexts such as invoices, delivery notifications, and HR documents
• Malicious links: URLs directing recipients to drive-by download sites that install malware automatically on page visit
• HTML email exploitation: malicious code embedded in email HTML that loads automatically when previewed in clients rendering active content
• Steganography: malicious code hidden inside image files that appear completely normal, bypassing scanners because the image itself passes inspection

The delivery evolution story that almost no competitor content covers is what makes this threat picture genuinely useful for IT administrators.

Early email malware used executable attachments. When email security gateways began blocking .exe, .bat, and .msi files as standard, attackers moved to weaponised Office documents with embedded macros. Macro-based delivery dominated corporate malware campaigns for over a decade.

In 2022, Microsoft enforced Mark of the Web protection, blocking VBA macro execution by default in Office files downloaded from the internet. Within weeks, threat intelligence researchers documented a significant shift: attackers moved to ISO and IMG disk image files and OneNote (.one) files, both of which bypassed the new macro protection entirely.

This is a documented cause-and-effect pattern. Each defensive control prompts a specific delivery method change. For IT administrators, the practical implication is direct: if your email gateway configuration has not been reviewed since before 2022, its blocking rules were built for a delivery threat profile that has already changed significantly.

What Are the Most Dangerous Types of Malicious Email Attachments?

Email attachment risk has shifted as security controls have blocked historically dangerous file types. The most dangerous attachment types in 2026 are not the ones most organizations currently prioritize blocking.

The two attachment types most actively exploited in 2026 that most email security tools have not adequately addressed are ISO/IMG disk image files and OneNote (.one) files.

ISO and IMG files mount automatically in Windows 10 and 11 when double-clicked, presenting their contents as a virtual drive with a drive letter assigned by the operating system. When an email gateway scans an ISO file, it scans the ISO container itself. Most tools do not scan the contents of the mounted virtual drive. The malicious executable inside is never analyzed. When the user double-clicks it from the mounted virtual drive, it executes without any security scan having examined it.

OneNote files became a documented primary delivery vector in late 2022 specifically because they bypassed Microsoft’s macro protection. A malicious .one file embeds scripts or executables behind clickable elements within the note. Clicking a button or image inside the file launches the embedded malicious content.

Many organizations’ email gateways still allow .one files because they were not historically associated with malware delivery before 2022. Blocking ISO, IMG, and .one attachments at the gateway is an immediately actionable defensive step. For detailed guidance on safe attachment handling, see Email Attachment Security: Safe Handling and Sandboxing Guide.

How Does Ransomware Spread Through Email?

Ransomware delivered by email follows a specific sequence that explains why early detection is the most important defensive factor.

Initial delivery: ransomware arrives as a malicious attachment disguised as an invoice, shipping notification, or business document, or as a link to a compromised website. Execution: the recipient opens the file or visits the page, downloading and running the ransomware payload. Privilege escalation: the ransomware gains administrator access and disables security tools. Network propagation: connected network shares and devices are scanned and targeted. Shadow copy deletion: Windows Volume Shadow Copies are deleted to block file recovery without payment. Encryption: files across local drives and network shares are locked and a ransom note is dropped.

The full sequence from initial click to widespread encryption can complete in minutes. Modern ransomware campaigns use double extortion, stealing data before encryption to create payment pressure even when organizational backups exist. The FBI IC3 tracks ransomware losses annually. Sophos reports average recovery costs of $2.73 million per incident when all direct and indirect costs are included.

What Is an Email Virus in Cyber Security?

An email virus is malware that spreads by self-replicating: the infected device accesses the email client’s contact list and sends copies of the malicious email to every contact, appearing to originate from the infected user. This mechanism leverages trust between contacts to increase open and click rates on the malicious emails.

Classic email viruses defined public awareness of email-based threats. ILOVEYOU (2000) infected tens of millions of computers within hours by emailing itself to every contact in Microsoft Outlook. Melissa (1999) forced major organizations to shut down email servers under the generated traffic volume. MyDoom (2004) became one of the fastest-spreading email worms on record.

Modern email threats have largely moved beyond self-replication to targeted, evasive delivery methods. The term email virus in cyber security is now commonly used to describe email-delivered malware broadly. Defenses against classic email viruses focused on detecting self-replication behavior; effective email malware protection today requires attachment sandboxing, URL analysis, and behavioral endpoint detection.

How Do Attackers Hide Malware in Email Links?

Malicious email links use several techniques to pass security scanning at delivery while remaining dangerous when clicked.

URL shorteners obscure the true destination, making shortened links appear clean regardless of the actual endpoint. Typosquatting domains register addresses visually similar to legitimate sites, such as arnazon.com versus amazon.com, relying on recipients not noticing the character difference. Compromised legitimate websites link to real domains with established good reputation scores that security scanners trust. Redirect chains route the initial URL through multiple hops before reaching the malicious destination, meaning the original link in the email appears clean during gateway scanning.

The most significant technique for security purposes is time-delayed URL activation: the link destination is clean at the moment of email delivery when gateway scanning runs, then switches to malicious content hours later when recipients click. Standard time-of-delivery URL scanning passes these emails as clean. Time-of-click URL rescanning, which re-evaluates the link destination at the moment the recipient clicks rather than at delivery, is the required countermeasure.

How Do You Detect Malicious Emails Before They Cause Damage?

Detecting email malware before it executes requires consistent behavioral checks applied to every email containing attachments or links.

Key detection indicators:

• Check the actual sending address behind the display name. Display names can be set to any text. The underlying sending address often reveals the fraud
• Hover over links before clicking to verify the true destination URL. Never trust the link text alone
• Treat any macro enable prompt as a red flag. Legitimate business documents do not require macro activation to be read or reviewed
• Watch for double extensions such as invoice.pdf.exe disguising executable files as document types
• Treat unexpected attachments as suspicious regardless of the apparent sender, as social engineering pretexts are specifically designed to make the attachment feel expected
• Use endpoint security tools that scan files before execution rather than only at download time

AI-powered detection tools now analyze email content patterns and sender behavior to flag suspicious emails even when no technical indicators are present. For a full email security controls checklist, see Email Security Best Practices: The Definitive 2026 Checklist.

How Do You Protect Against Email Malware?

Email malware protection requires a layered approach. No single control addresses all delivery methods. Successful malware infections typically exploit the gap between layers.

The core protection stack:

• Deploy a secure email gateway with attachment sandboxing. Sandboxing detonates suspicious files in isolation before delivery, catching threats that signature-based scanning misses. See What Is a Secure Email Gateway (SEG)?
• Implement URL rewriting with time-of-click rescanning to catch delayed-activation malicious links that pass clean at delivery
• Disable Office macros via Group Policy, allowing execution only from trusted locations
• Block ISO, IMG, and .one files at the email gateway to close the current primary delivery bypass routes
• Deploy EDR on all endpoints to detect malware that bypasses email gateway filtering
• Keep all software patched: email malware frequently exploits known vulnerabilities in Office and PDF readers
• Implement SPF, DKIM, and DMARC to reduce spoofed sender delivery

Cyber Security Solutions Ltd offers a free email security assessment to evaluate whether your current controls address the most active delivery methods targeting businesses like yours.

Conclusion

Email malware delivery methods evolve in direct response to each security control deployed against the previous generation of attacks. Blocking executable attachments addressed the threat from five years ago. Blocking ISO, IMG, and OneNote files addresses the threat active today. Visit cybersecuritysolutionsltd.com to get a free email security assessment and verify whether your current controls are matched to the delivery methods currently being used against businesses in 2026.