That File Isn't What It Says It Is: How Hackers Use Fake Extensions to Trick You

You get an email. It's from what looks like FedEx, or your bank, or maybe your own HR department. There's an attachment. It's labeled something like shipping_notice.pdf or w2_form_2024.docx. You've been expecting something like this. You click it.

Except it wasn't a PDF. It wasn't a Word doc. It was a program — and the moment you double-clicked it, something very bad started happening in the background.

This is one of the oldest tricks in the cybercriminal playbook, and it still works. A lot. Let's break down exactly how.

Your Computer Is Hiding the Truth From You

Here's something that surprises a lot of people: by default, Windows hides file extensions from you.

That means a file named resume.docx just shows up as resume in File Explorer. The .docx part is invisible unless you go into your folder settings and specifically turn extensions back on. Microsoft made this decision years ago thinking it would make the interface cleaner and less confusing for everyday users. The unintended side effect? It made it way easier for attackers to name malicious files whatever they want.

If extensions are hidden, a file named resume.docx.exe just looks like resume.docx. The dangerous .exe part — the part that tells your computer to run the file as a program — is completely out of sight.

The Double Extension Trick

This is probably the most common file-based deception out there. It's exactly what it sounds like: a file with two extensions, where the real one is hidden at the end.

Some examples you might encounter in the wild:

• invoice.pdf.exe — Looks like a PDF, runs like a program
• photo.jpg.vbs — Appears to be an image, actually a Visual Basic script
• document.docx.bat — Seems like a Word file, executes commands on your system
• report.xlsx.scr — Looks like a spreadsheet, actually a screensaver file (which Windows treats as executable)

The extension that matters — the one Windows actually uses to decide what to do with the file — is always the last one. Everything before it is just decoration, as far as your operating system is concerned.

It Gets Sneakier: Unicode Tricks and Lookalike Characters

Double extensions are just the beginning. Sophisticated attackers have a few more tools in the kit.

The RLO trick. Unicode, the system that lets computers display characters from virtually every language on earth, includes a special character called Right-to-Left Override (RLO). It's meant to help display Arabic or Hebrew text, which reads right to left. But attackers use it to reverse how a filename appears on screen.

So a file actually named malware_gpj.exe can be made to display as malware_exe.jpg using a hidden RLO character in the middle of the filename. Your eyes see a JPEG. Your computer sees an EXE. This one is particularly nasty because there's nothing visually wrong with the filename — it just appears to say something it doesn't.

Homoglyph attacks. This is where characters from other alphabets get swapped in to create filenames that look identical to legitimate ones. The Cyrillic letter "а" looks almost exactly like the Latin letter "a" but is technically a different character. A file named résumé.pdf using lookalike Unicode characters might not be what it claims, especially if it came from an untrusted source.

Icon spoofing. Windows shows file icons based on the file type — a little Adobe logo for PDFs, a Word logo for .docx files. Malware can be packaged with a custom icon that mimics these familiar logos. So even if you're looking at an .exe file, it might display a PDF icon. Combined with hidden extensions, this creates a very convincing fake.

Real-World Scenarios Where This Bites People

This isn't theoretical. These techniques show up constantly in phishing campaigns targeting everyday Americans.

Tax season is a goldmine for attackers. Emails claiming to be from the IRS, TurboTax, or your employer's payroll system arrive with attachments like W2_2024.pdf.exe. People are expecting tax documents. They're stressed. They click.

Job seekers are another common target. Fake recruiters send "job offers" with attachments like offer_letter.docx.js — a JavaScript file that can run malicious code through Windows Script Host.

Small business owners frequently get fake invoices. Invoice_March.xlsx.exe is a classic. It looks like a routine accounting file. It is not.

How to Protect Yourself — For Real

The good news is that a few simple habits will dramatically reduce your exposure to this stuff.

Turn on file extensions in Windows. Open File Explorer, click the View tab (or the three-dot menu in Windows 11), and enable "File name extensions." Do this right now. Seriously. This single change makes double extension attacks immediately visible.

Be suspicious of any executable file that arrives via email. Files ending in .exe, .bat, .vbs, .js, .scr, .cmd, or .ps1 should never arrive in your inbox from someone you don't know. Even if you do know the sender, verify before opening.

Check the file type, not just the name. On Windows, right-click any file and choose Properties. The "Type of file" field shows you the real file type, regardless of what the name says. This is the ground truth.

Use a modern antivirus with real-time protection. Windows Defender, which is built into Windows 10 and 11, is genuinely solid these days. Make sure it's on and updated. It catches a lot of these tricks before they execute.

Hover before you click in email. Most email clients show you the actual file name when you hover over an attachment. Take two seconds to look at it carefully before downloading.

Be extra skeptical of compressed files. A .zip or .rar attachment can contain anything. Attackers often wrap malicious executables in zip files specifically because some email filters scan attachments but not the contents of archives.

The Takeaway

File extensions aren't just labels. They're instructions. When your computer sees .exe, it doesn't ask questions — it runs the file. That's exactly why attackers work so hard to hide the real extension behind a fake one.

You don't have to be a security expert to protect yourself here. You just have to slow down for a second before clicking, know where to look, and make sure Windows isn't hiding the most important part of the filename from you.

The criminals are counting on you being in a hurry. Don't be.