Most people know not to open suspicious files. The problem is that suspicious files rarely look suspicious. They arrive as invoices, installation packages, software updates, and video downloads, using the same extensions you interact with every day. This tier list breaks down which file types carry real risk, why they're dangerous, and how attackers actually use them.
.exe
This is the one most people have heard about, and the reputation is earned. An executable file on Windows runs directly on your system with whatever permissions your account has. There's no sandbox, no preview, no buffer. You click it, it runs.
The reason .exe remains the weapon of choice for malware distributors is simple: it works. Free software downloads, game cracks, and fake system utilities have been delivering malicious executables for decades. WannaCry, the ransomware that hit hospitals, banks, and government systems across 150 countries in 2017, is the most well-known example. It didn't need anyone to click a suspicious link. Once it was inside a network, it spread on its own. Even with antivirus software running, newly written malware routinely evades detection for days or weeks after release.
The rule is straightforward. If an .exe didn't come from the official website of the software it claims to be, don't open it.
.sh
Shell scripts are the .exe equivalent for Mac and Linux users, and they tend to fly under the radar because the people most likely to receive them are developers who run scripts regularly. That familiarity is exactly what makes them dangerous in the wrong hands.
A single line in a shell script can delete your home directory, open a backdoor to a remote server, or silently install software that persists across reboots. The attack vector is usually a GitHub repository, a forum post, or a "setup guide" that instructs you to run a script to install something. Before running any .sh file from an unknown source, open it in a text editor first. It's plain text. Read it.
.apk
Android apps installed outside the Google Play Store bypass Google's review process entirely. The .apk format is how Android applications are packaged and distributed, and while sideloading has legitimate uses, it's also how most Android malware reaches devices.
Attackers typically wrap malicious .apk files in the packaging of popular paid apps offered for free, or distribute them through links sent via SMS or messaging apps. Once installed, a malicious app can request access to your contacts, messages, camera, microphone, and location. In many cases users grant these permissions without reading them.
If you didn't install it from the Play Store, treat it with suspicion.
.zip
The archive format itself is harmless. The issue is that you have no idea what's inside until you extract it, and some antivirus tools struggle to scan compressed archives, particularly password-protected ones. Attackers frequently use passwords on malicious zip files specifically to prevent automated scanning.
Phishing emails with attachments named "invoice.zip", "shipment_details.zip", or "contract.zip" are a persistent and effective delivery method for malware. The zip gives the payload one extra layer of legitimacy and one extra barrier against detection.
.dmg
Mac users see .dmg files constantly. It's the standard format for distributing Mac applications, which means most people open them without a second thought. That trust is the attack surface.
Fake Adobe Flash updaters distributed as .dmg files were among the most common macOS malware delivery mechanisms for years. The pattern is always the same: a convincing prompt telling you that a plugin is out of date, a download link, and a .dmg that installs something you didn't ask for alongside something you thought you were getting. The idea that Macs don't get malware has been outdated for a long time.
.iso
Disk image files are associated with large, legitimate software distributions: operating system installers, software suites, archived backups. That association makes them feel trustworthy, and some security scanners don't inspect their contents thoroughly.
Fake Windows .iso files distributed through torrent sites are a recurring problem. Users searching for a copy of Windows download what looks like a legitimate disk image and end up with a compromised installation. Microsoft has also been impersonated through malicious .iso files sent via email, particularly in targeted attacks against businesses.
The PDF is the most trusted document format in professional environments, which is precisely why it's so useful to attackers. A well-crafted fake invoice, contract, or HR document attached to a phishing email will get opened at a far higher rate than anything that looks unfamiliar.
Beyond social engineering, PDFs can contain embedded JavaScript and hyperlinks that execute on open or redirect to credential-harvesting pages. The 2020 SolarWinds supply chain attack, one of the most significant cyberattacks in recent history, used PDF attachments as part of its initial access strategy. Opening PDFs in an up-to-date reader with JavaScript disabled in the settings reduces the risk considerably.
.docx
Office macro attacks have been around since the late 1990s and they still work. A malicious Word document typically displays a notice saying the file was created in an older version of Office and asks you to click "Enable Content" to view it properly. That click runs a macro.
Emotet, one of the most destructive malware operations ever documented, ran for years using infected Word documents as its primary delivery mechanism. It infected hundreds of thousands of systems across governments, hospitals, and corporations before an international law enforcement operation took it down in 2021. The document looked completely normal until you enabled that macro.
If a Word document you weren't expecting asks you to enable macros, close it.
.svg
SVG files are images, technically. In practice, they're XML documents that a browser renders as graphics, and XML documents can contain scripts. Open an SVG in a browser and any embedded JavaScript runs just like it would on a webpage.
This makes .svg an unusual attack vector because most people treat image files as inherently passive. An SVG received through a messaging app or downloaded from an untrusted site can execute code in your browser while displaying a completely normal-looking image. It's not a common attack vector, but it's underestimated precisely because it looks like a picture.
.mp4
Video files can't execute on their own, which puts .mp4 at the safer end of this list. A video file needs a media player to open, and by itself it won't do anything to your system.
The main thing to watch for is double extensions. A file named "movie.mp4.exe" is actually an executable, not a video. Windows hides known file extensions by default, so it shows up in File Explorer as "movie.mp4" with a video icon. Turning on "Show file name extensions" in Windows settings takes about ten seconds and makes this trick immediately obvious. One more thing worth knowing: keeping your media player updated matters. Outdated players have been exploited through malformed video files before, even without the user doing anything wrong.
The single most reliable protective habit isn't antivirus software or firewalls. It's pausing for three seconds before opening any file that arrived unexpectedly, regardless of who it appears to be from, and regardless of how normal the extension looks. Attackers don't rely on technical exploits alone. They rely on the fact that most people are busy and don't stop to check.