Email malware

Email malware is malicious software that arrives in an email and can be installed when you open an attachment or click a link. The email is only the delivery method: the harmful code is hidden inside the attached file or on the web page that the link opens.

You do not infect a computer simply by receiving or opening an email. The infection happens when you take the next step and run the attachment or follow the link, because that is when the malicious code is allowed to execute. For example, an email might claim to be a cinema sending your booking receipt, with an attachment called booking-receipt.pdf.exe. The end of the name tells the computer to run it as a program, but the .pdf part makes it look like an ordinary document, so opening it can install malware on your device. A link can work in a similar way: it may look like a normal web address but take you to a page that tries to run harmful code.

Reducing the risk

Treat unexpected attachments and links with suspicion, especially if the message is urgent, asks you to sign in, or comes from an address you do not recognise. Do not open the attachment or click the link.

• Do not open suspicious attachments or links: this stops any hidden program from running, so the malware never gets the chance to install.
• Delete the email: removing it reduces the chance that you or someone else opens it by mistake later.
• Report it: telling your email provider or school IT team can help them block the sender and warn other users, which protects them from the same message.