Disguising Executables via Special Characters and Double Names
Attackers give files double extensions like "Invoice.pdf.exe", or use invisible text direction-changing characters (RLO). As a result, users see a safe text file icon, but the OS launches a ransomware loader script.
Rules for Checking Suspicious Attachments
- enable showing known file type extensions in system folder settings
- avoid extracting password-protected archives from unknown senders
- check suspicious files via online sandboxes before opening them on a work computer
- block macro execution in text editors and spreadsheets when opening attachments