Attackers use Double File Extension to make a dangerous file look harmless, such as by hiding an executable behind a familiar document-style name. Users may open it by mistake, especially if file extensions are hidden. Defenders should show full extensions, block risky attachment types, and inspect downloads that rely on misleading names.
How Double File Extension Attacks Work
double file extension work by exploiting the way people and some interfaces read filenames. The attacker makes the visible name look like a harmless document, then places the dangerous type at the end so the true file type is overlooked. The technique depends on hurried review, hidden extensions, and the assumption that the first familiar label tells the whole story.
This is usually not a standalone exploit in the technical sense. It is a deception method that supports malware delivery, phishing, and unwanted execution by making a file seem safe enough to open.
When the lure is part of a broader phishing chain, defenders should treat the filename as one signal among several and review the full delivery path, not just the file icon or first extension. The same pattern often appears alongside attachment abuse, lookalike naming, and social engineering, which is why the wider Phishing Guide is the most useful NHIMG starting point for the delivery mechanism behind this trick.
Why Users Miss the Real File Type
Double extensions succeed because many users scan filenames visually rather than parsing them carefully. A name like invoice.pdf.exe can appear document-like at a glance, especially when the operating system hides known extensions or truncates long names in previews, email clients, or chat windows.
The attacker is trying to create a mismatch between what the user thinks they are opening and what the system will actually execute. That mismatch is most dangerous when file associations, preview panes, or thumbnail rendering make the item seem routine.
In practice, this is a filename deception problem first and a malware problem second. The deceptive naming only matters because it lowers scrutiny at the exact moment the user is deciding whether to open the attachment or download.
Where the Technique Becomes Dangerous
Double extension attacks become more serious when the malicious file can launch code, install a payload, or trigger a follow-on download after the user opens it. The technique is especially effective in email, chat, cloud-share links, and helpdesk workflows where users expect to receive documents quickly and may trust a familiar business format.
A second danger is that the name may not be the only trick. Attackers often pair the extension spoofing with archive nesting, icon spoofing, or document-like content so the file looks more convincing even after a superficial check.
That is why attachment controls matter. A file named to resemble a document can still be executable, scriptable, or embedded with other malicious content. The question for defenders is not just “what does it look like?” but “what will the operating system do if someone opens it?” The same file-type ambiguity is a core concern in the File Upload Security Guide, especially where extension checks and content validation must agree before a file is accepted.
Risk and Threat Considerations
Double file extensions are a low-cost way for attackers to reduce user suspicion and increase the chance that a malicious attachment is opened. The risk is highest in environments where extensions are hidden by default, users process many external files, or file-type controls rely on filename checks alone.
Failure mechanism: The attacker exploits human pattern matching and UI shortcuts, then relies on the operating system or associated application to execute the real file type after the misleading name has done its job.
Impact: The result can be malware execution, credential theft, additional payload delivery, or a foothold for later compromise, depending on what the disguised file actually contains.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-9 — Email and Web Browser Protections | Controls the delivery path used by deceptive attachments and downloads. |
| CIS-10 — Malware Defenses | Stops malicious payloads hidden behind misleading filenames. | |
| CIS-16 — Application Software Security | Supports validating file type handling and reducing misleading file execution paths. | |
| Recommendation — Filter risky attachments and harden email and browser handling for external files. Scan downloads and block executable content that masquerades as documents. Verify that software reveals and enforces the true file type before execution. | ||
| OWASP ASVS | V5 — File Handling | File-name tricks are directly related to secure upload and download handling. |
| Recommendation — Validate file type by content, not extension alone, before accepting or processing files. | ||
| MITRE ATT&CK | T1036 — Masquerading | Double extensions are a classic masquerading technique that hides malicious intent. |
| Recommendation — Detect and flag files that disguise their true type with misleading names. | ||
Practitioner Guidance
What to verify: Confirm that full extensions are visible everywhere users review files, including email clients, file explorers, browser downloads, and remote desktop sessions. If the interface truncates or hides the final extension, users are making decisions without the information that matters most.
Decision rule: If the visible name and the actual file type do not match, treat the item as suspicious even when the first extension looks familiar. If the file arrived through email or chat and the sender context is weak, require inspection before opening rather than relying on user judgment alone.
What practitioners underestimate: This technique often survives basic awareness training because it works against hurried attention, not ignorance. The most effective control is making the real extension visible and using gateway or endpoint policies to block risky attachment types before a user has to make a decision.
Practitioner takeaway: Double extensions are effective because they turn a filename into a trust trap, so the defensive priority is to remove ambiguity at the interface and stop risky file types before they reach the user.