A double-extension lure is a file that uses two extensions to disguise an executable or script as a document type. The technique exploits how users read filenames and how some systems hide the true executable nature of the file, making it a common first-step deception in malware delivery.
How Double-Extension Lures Work
A double-extension lure relies on filename ambiguity. The visible name suggests a harmless document, while the final extension reveals a script or executable that can run when the file is opened, double-clicked, or handled by a vulnerable workflow.
This works because many people scan only the first part of a filename, and some interfaces suppress the last extension or make it easy to miss. The result is a social-engineering trick built on visual trust, not on any weakness in the malware itself.
Why Double-Extension Lures Are Effective
The technique is effective in environments where filenames are trusted too quickly, especially when users exchange files through email, chat, shared drives, or download portals. It exploits the gap between what the filename appears to say and what the operating system or application actually interprets.
It is especially dangerous when combined with a familiar document icon, urgent messaging, or a convincing sender impersonation. The lure does not need to be technically advanced if the delivery path can persuade a user to launch it.
How Organisations Reduce Exposure
Exposure starts with knowing where executable-capable files can enter the environment and where file extensions may be obscured. Organisations should review attachment handling, download filtering, endpoint configuration, and user-facing file browsing settings so that the true file type is easier to see.
Controls that reduce exposure include showing full filename extensions, blocking or warning on dangerous file types, restricting execution from user-writable locations, and using mail and web gateways to detonate or inspect suspicious attachments before delivery.
Training also matters, but it should support technical controls rather than replace them. A well-configured environment makes the lure easier to spot and less likely to succeed even when a user is distracted.
Detection and Response After Delivery
If a double-extension lure is opened, detection depends on whether the file actually executed and what it touched next. Security teams should review endpoint alerts, process creation, child processes, file writes, network connections, and any unusual persistence or credential access that follows the initial launch.
Post-delivery review should also look for the original artefact, because the filename, hash, download source, and mailbox or browser trail can reveal the delivery chain. If execution occurred, the response should treat the event as a likely malware execution attempt, not just a user mistake.
Risk and Threat Considerations
Double-extension lures are a common first-step deception because they create a false sense of safety before a malicious payload runs. The main risk is not the filename itself, but the opportunity it gives an attacker to get code execution through user trust and weak file-type visibility.
Failure mechanism: The user sees the benign-looking portion of the name, or the interface hides the dangerous extension, and the file is opened as if it were a document instead of an executable or script.
Impact: The result can be malware execution, initial foothold, follow-on credential theft, persistence, or additional payload staging through the compromised endpoint.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-9 — Email and Web Browser Protections | Double-extension lures commonly arrive through email and web downloads. |
| CIS-10 — Malware Defenses | The lure is designed to deliver malware through deceptive file execution. | |
| Recommendation — Filter risky attachments and downloaded files before they reach users. Block malicious file types and inspect suspicious attachments with malware defenses. | ||
| MITRE ATT&CK | T1036 — Masquerading | The technique disguises a malicious file as a harmless document. |
| T1204 — User Execution | The lure depends on a user opening the file to trigger execution. | |
| Recommendation — Hunt for masquerading filenames and deceptive extension patterns in your detections. Alert on user-triggered execution from downloaded or attached files. | ||
Practitioner Guidance
What to watch for: Treat any file that appears to be a document but ends in a second, dangerous extension as suspect, especially if it arrives by email or from an untrusted download source. The key judgment is whether users and tooling can clearly distinguish the displayed name from the actual execution type.
Practitioner takeaway: The most reliable defence is to remove filename ambiguity before the user ever has to decide whether the file is safe.