Viruses and malware in email
What is a virus in email?
A "virus in email" is a collective term for malware, malicious software, that is spread via email. Think of an infected attachment, a link to an infected website, or a document that asks you to "enable macros" so as to then run malicious code.
The goal varies: encrypting your files and demanding a ransom (ransomware), quietly reading along, or using your device to attack others. The spread almost always goes hand in hand with a trick to get you to click; that's why malware often goes hand in hand with phishing, where the fake mail forms the bait.
A few common forms you'll encounter via email:
- Ransomware encrypts your files and demands payment to release them again.
- Trojan horses hide in a seemingly useful file and open a back door on your device.
- Spyware and keyloggers quietly read along and intercept your passwords, for example.
- Worms spread themselves further to your contacts, often from your own mailbox.
The packaging changes constantly, but the way in stays the same: a file or link that tempts you to click.
Why a virus in email does so much damage
One infected attachment can bring down a whole organization. Ransomware can make your administration, customer data and accounting inaccessible; for an SME or practice, work then grinds to a halt, with costs and reputational damage as a result. And if your mailbox gets infected, the malware sometimes spreads further to your own contacts.
For anyone who works with sensitive data, it weighs extra heavily. A data breach through malware is not only annoying, but can also be reportable. Prevention is therefore much cheaper than cleaning up afterwards, and fortunately also a lot simpler.
Email is moreover still the most popular starting point for attacks on businesses, precisely because it's so accessible: one message to the right person is enough. Attackers don't need to carry out a complicated technical break-in if they can tempt someone to open the door themselves. That makes the user the first and the last line of defense, and explains why awareness is at least as important as the software watching along in the background.
How it works
Malware in email almost always needs one thing: for you to do something. Receiving or reading the message is usually harmless; it goes wrong only at the next step.
- You receive a message with an attachment or link that looks legitimate (an invoice, a parcel notification, a CV).
- You open the attachment or click the link.
- Often another nudge follows: "enable editing", "allow macros", or "download the update".
- As soon as you do that, the malicious code runs and the malware nests itself on your device.
Risky file types include executables and scripts, but also seemingly ordinary documents with macros, and sometimes a zip file that hides such files. Good filtering intercepts a lot of this before it reaches you; how that works, you can read in how a spam filter works.
What to watch out for
- Don't open unexpected attachments, certainly not executables or documents that ask you to enable "editing" or "macros".
- Really check the sender, not just the displayed name. An infected attachment often comes from a spoofed or hijacked sender.
- Be alert to unexpected invoices, parcel notifications and CVs. Those are the classic packaging for malware.
- Don't click links blindly; check where they really point and, when in doubt, go to the known website yourself.
- Keep your systems up to date and make regular backups, so that with ransomware you can fall back on a clean copy.
- Did you click anyway? Disconnect your device from the network, have it checked, change your passwords and report it to your provider or IT manager. Acting quickly limits the damage.
A reassurance: you don't have to become paranoid. Most infections require an active step from you. Anyone who doesn't open unexpected attachments, checks links and keeps systems up to date already closes most of the door. The combination of healthy distrust and good filtering is surprisingly effective in practice.
If legitimate mail is instead disappearing into spam while you want to keep malware out, that's a different trade-off; you can read about that in why mail lands in spam.
And at Mailflux
At Mailflux, every plan includes standard antivirus, anti-spam and anti-malware, and machine learning filters against spam, phishing and malware. That way a large part of the infected attachments and links is already stopped before they reach your inbox. The plans with premium anti-malware offer more extensive protection.
In addition, every plan makes automatic backups, which in a ransomware incident makes the difference between panic and simply restoring. You get professional email on your own domain, hosted in Europe and GDPR-compliant, with optional two-step verification. Filtering does the heavy lifting; your alertness forms the last layer.
FAQ
Frequently asked questions
Do I get a virus by opening an email?
Merely reading a message is usually safe. The risk is in what you do afterwards: opening an attachment, clicking a link or "enabling macros". As long as you don't touch suspicious attachments and links, nothing happens, even though the mail is in your inbox.
Which attachments are the most dangerous?
Executables and scripts are the riskiest, but so are ordinary documents with macros and zip files that hide such files. Be especially wary of unexpected invoices, parcel notifications and job applications, because those are the classic packaging for malware.
What do I do if I've opened an infected attachment?
Disconnect your device from the internet and network, have it checked with up-to-date security software, and change your passwords from a clean device. Report it to your provider or IT manager and, if necessary, restore from a recent backup. The faster you react, the more limited the damage.