PlayInfoBox

Home /Utilities /How to Spot Disguised File-Extension Malware

How to Spot Disguised File-Extension Malware

Tap an item to see how to recognize disguised executable files.

The Double-Extension Disguise

A file like "photo.jpg.exe" is actually a program, but with a photo or document extension tacked on in front -- so when extensions are hidden in your file browser, it looks like an ordinary photo or document.

Always Show File Extensions

Most systems hide the extensions of known file types by default. Turning on "show file extensions" in your file manager's view settings makes double-extension disguises much easier to spot.

Check Whether the Icon Matches the File Type

A file can display a document or photo icon while actually being an executable (.exe, .scr, .bat, and similar). With extensions visible, get in the habit of checking that the icon and the extension actually match.

Learn the Common Disguise Patterns

Names like "resume.docx.exe" or "invoice.pdf.exe" -- a familiar document extension followed by an executable one -- are a common pattern. Always check the full filename of attachments you receive by email or chat.

Scan Attachments Before Opening Them

Make it a habit to scan email or chat attachments from uncertain sources with antivirus software before opening them, so a disguised malicious file gets caught before it runs.

Watch Out for Macro-Enabled Office Files Too

Beyond disguised extensions, ordinary-looking document formats (like .doc or .xls) can hide malicious macros. Don't approve a macro-enable prompt for a document from a source you don't fully trust.

One Setting That Closes Off a Lot of Risk

When file extensions are hidden by default, it becomes very hard to tell a genuine photo or document from a program disguised as one. Simply switching your file manager to always show extensions dramatically strengthens your defense against this trick.

Often Distributed Alongside Phishing and Smishing

Disguised executables are frequently sent as attachments in phishing emails or scam text messages, so it pays to make a habit of checking the sender at the same time as checking the file extension.

Frequently Asked Questions

Do similar disguised files exist on a Mac?

macOS handles extensions differently from Windows, but disguising malicious software as an ordinary-looking app or installer still happens. Regardless of operating system, get in the habit of checking any file from an unclear source before opening it.

What should I do if I already ran a suspicious file?

Disconnect from the internet immediately and run a full scan with your antivirus software. If the computer keeps behaving oddly afterward, it's safest to get further help from a professional or the manufacturer's support line.