Published August 31, 2026
The Email Attachment I Shouldn't Have Opened
An email landed in my inbox from a company I genuinely do business with, subject line mentioning an invoice, attachment right there ready to open. I clicked it almost automatically, the way you do with something routine and expected, and only actually looked at the sender's address properly after the file had already opened.
The Problem
The address was close to the real company's domain but not quite right — a subtle misspelling, one letter swapped, easy to miss at a glance and exactly the kind of detail I'd walked straight past without checking. The attachment itself had opened a document that looked mostly blank, with a prompt asking me to enable additional content to view it properly, which in hindsight was itself a fairly obvious warning sign I'd been too quick to dismiss.
What I Initially Thought
My first thought, in the moment right after realizing the sender's address was wrong, was pure alarm — a fast mental scramble through everything the file might have done in the few seconds it had been open, and how bad this was actually going to turn out to be.
What I Tried
I hadn't clicked "enable content" on the prompt, which mattered enormously, since that's typically the actual trigger point for anything genuinely harmful embedded in a document like that — opening the file alone is generally far less risky than actively enabling whatever it's asking permission to run. I closed the document immediately without enabling anything, then ran a full scan with Windows Security to check for anything that might have gotten through regardless.
What I Discovered
The scan came back clean, which was a real relief, though I didn't take that as absolute proof nothing had happened — I also changed the password on the account associated with that real company, just as a precaution, and kept a closer eye on that account's activity for a while afterward. Reading a bit more into it afterward, I learned that this specific pattern — a spoofed sender address closely mimicking a real company, paired with a document requesting you "enable content" — is a well-documented, common approach precisely because it exploits exactly the kind of routine inattention I'd fallen into.
What stuck with me most was how ordinary the whole email had looked. Nothing about it screamed suspicious at a glance. The tell was small and specific — one letter in a domain name — and I'd walked right past it because I wasn't actually looking for it.
What I Changed
I check the actual sender address now, not just the display name, on anything involving an attachment or a link, especially when it claims to be from a company I do business with. I also never click "enable content" on a document I wasn't specifically expecting, regardless of how legitimate the surrounding email looks, since that single click is usually the actual point of no return.
The Lesson
Not clicking "enable content" turned out to matter more than I realized in the moment — it was the difference between a scare and an actual problem. I think the broader lesson is that the routine, expected-looking messages are exactly the ones worth a second glance, precisely because they're the ones we're least likely to scrutinize.
Practical Takeaway
- Check the actual sender email address, not just the display name, especially on anything claiming to be a routine invoice or business document.
- Never click "enable content" or "enable macros" on a document you weren't specifically expecting, regardless of how legitimate the email looks.
- If you've already opened a suspicious attachment, run a full antivirus scan immediately, and change any related account passwords as a precaution.
- A spoofed domain often differs from the real one by just a single letter — look closely rather than glancing.
- Routine, expected-looking messages deserve more scrutiny, not less, since that's exactly what makes them effective.
A Personal Ending
I think about how automatically I clicked that attachment, purely because the subject line matched something I was routinely expecting to see. Since then, checking the actual sender address is a habit rather than an afterthought, on every single attachment, expected or not.
Had a close call with something that looked routine but wasn't? I'd like to hear about it.