How do attackers use spearphishing attachments?

How spearphishing attachments work as an initial access tactic

Spearphishing attachments are usually designed to lower suspicion, not to look obviously malicious. The attacker uses a familiar business context, such as an invoice, document review, or shared file notice, so the target is more likely to open the attachment and enable its contents. The core technique is social engineering wrapped around file-based delivery.

The attachment itself is only the delivery vehicle. It may contain embedded malware, exploit a document viewer weakness, or prompt the user to run a macro, script, or other active content. In practice, the attacker is trying to convert one successful open into a foothold that can be used for credential theft, persistence, or follow-on access.

Because the payload is file-based, the risk often depends on what the recipient’s environment allows: which file types are trusted, whether scripts and macros execute, and whether content from external senders is isolated before it reaches the endpoint. For a broader defensive view of phishing patterns, the Phishing Guide covers common lure types, attachment abuse, and layered defenses.

Why attackers favour attachments over plain links

Attachments can feel more legitimate than a message asking someone to click through to a website. A file may appear to be a contract, statement, or internal memo, which gives the attacker a better chance of bypassing casual scrutiny. That legitimacy also helps them target specific roles, because the lure can be tailored to the recipient’s workflow and document expectations.

Attachments also create a flexible payload stage. Some campaigns rely on macros or script launching, while others use archive files, HTML smuggling, weaponized PDFs, or other formats that place the malicious action inside the file itself. The common objective is to hide the malicious step inside something the user thinks is routine document handling.

For defenders, the practical implication is that file reputation alone is not enough. A document can be unique to the target and still be malicious, so detection has to combine sender context, attachment type, content inspection, and whether the file requests unusual user action. The MITRE ATT&CK Enterprise Matrix is useful for mapping this behaviour to credential access, execution, and lateral movement paths.

What defenders should examine before a file reaches the inbox

Effective control starts with reducing the number of attachment paths that can execute code or stage secondary payloads. High-risk formats, especially those that support embedded scripts, active content, or executable-like behaviour, should be restricted wherever business need allows. External attachments should be filtered, sandboxed, or detonated before delivery to the user when the content is not essential to immediate workflow.

Inspection should focus on both the file and the message around it. A benign-looking document can still be dangerous if it arrives from an unusual sender relationship, contains a mismatched filename or extension, or tries to persuade the user to bypass normal protections. Security teams should treat requests to enable content, open protected views, or “fix” a document as part of the attack chain, not as user inconvenience.

At the identity layer, the biggest downstream issue is often what the attachment enables after initial execution. If the payload captures credentials, session material, or mailbox access, the incident moves from file risk to account compromise. That is why the The State of NHI & AI Agent Breach Report 2026 is relevant here: it shows how initial access commonly turns into stolen tokens, service account abuse, and broader compromise.

Risk and Threat Considerations

Spearphishing attachments are attractive because they exploit trust in ordinary business documents and the expectation that files are safe if they arrive in a familiar format. The real danger is not just malware delivery, it is that one open can create a durable access path if the attachment captures credentials or executes code on a trusted workstation.

Failure mechanism: The attacker disguises a malicious payload as a credible document, then relies on user trust, macro execution, or file parsing behaviour to trigger code execution or credential capture.

Impact: A successful open can lead to malware infection, account compromise, lateral movement, and follow-on phishing from a trusted mailbox or endpoint.

Practitioner Guidance

What to verify: Check whether your mail and endpoint controls actually block or detonate the attachment types your users receive most often. If risky formats are still reaching end users, the gap is usually policy coverage or exception handling, not user awareness.

Decision rule: If the attachment can execute code, launch a script, or request macro enablement, treat it as a high-risk delivery path and require sandboxing or equivalent isolation before the file is opened in a production user context.

What practitioners underestimate: The first malicious effect is often not the final one. Even when the attachment does not install malware directly, it may still trigger credential theft or mailbox compromise that makes later intrusion far easier.

Practitioner takeaway: The most useful control question is not whether a file looks legitimate, but whether the environment lets that file cross from “viewed” to “executed” without a strong inspection step in between.

Related resources from NHI Mgmt Group

• How do attackers use list planting?
• How do attackers use invisible Unicode?
• How do attackers turn a supply-chain incident into wider NHI compromise?
• How do attackers operationalise stolen OAuth tokens at scale?