Klytic

Home›Guides›Email security

Email security · Understand

Attachments, links and ransomware received by email

For ANSSI, the French national cybersecurity agency, email is the main vector for infecting workstations: a single attachment or link is enough to let in malware, ransomware included. A filter placed before the mailbox can analyze files and links, remove a dangerous attachment and recheck a link at the time of click. It replaces neither user caution nor a backup the attacker cannot erase.

Updated October 20266 minOfficial sources cited

What is examined in an attachment

  • Antivirus: comparison with known malware. Effective against what is already circulating, less so against a file crafted for a single campaign.
  • Office macros: a Word or Excel document that contains code and asks you to “enable content” to run it. It is an old pattern, still in use.
  • PDFs: scripts, hidden links, forms that lead to a fake login page.
  • HTML files: an attachment that opens in the browser and imitates a login page, without going through a website that could be blocked.
  • Images: a QR code containing a link, or text hidden in the image to evade text analysis.

When an attachment is deemed dangerous, two outcomes are reasonable: remove the attachment and deliver the message with a note explaining why, or quarantine the entire message. Either way, the file does not reach the workstation.

Links: at delivery, then at click time

A link is analyzed in the message: reputation of the URL and the domain, resemblance to a well-known brand, recently created domain. QR codes pose a particular problem: they move the link from the computer, which is protected, to the personal phone, which often is less so. Reading the code in the image brings that link back under control.

But a link that is safe at 9 a.m. can be malicious by 2 p.m. Fraudsters first send a link to a harmless page, then change the page once the message has been delivered. That is the reason for time-of-click protection: the link is rewritten so that it goes through a check at the moment the user clicks. If the page has become dangerous, the click is stopped, even though the message was delivered.

The case of sharing links

More and more malicious messages contain no attachment at all: they point to a document stored on a well-known file-sharing service. The link’s domain then has an excellent reputation, since it belongs to a major service. The analysis has to focus on everything else: is the sender a usual one, does the message look like a campaign, does the page that opens ask for a password? This is where time-of-click checks and detection of unusual behavior matter more than a list of dangerous domains.

Ransomware: what the gateway can do, and what it cannot

Cybermalveillance.gouv.fr describes ransomware as an attack that blocks access to a system or encrypts data, and sometimes threatens to disclose it, in exchange for a ransom. The service notes that the intrusion generally comes through a vulnerability or poorly secured remote access, or through the compromise of an account or machine via phishing or malware.

Email is not the only way in, but ANSSI identifies it as “the main vector for infecting workstations” (translation). The same agency cites “sending malicious attachments to exploit workstation vulnerabilities for ransom or espionage purposes”. It is also an entry point that can be filtered before it reaches the mailbox. The typical sequence by email:

  1. a message with an attachment or a link;
  2. a macro enabled, or a password entered on a fake page;
  3. access to the network or to accounts;
  4. later, sometimes weeks afterwards, encryption of the files.

An example, for illustration only. An employee receives an “unpaid invoice” as a Word document. The document displays a blurred banner and asks the user to enable content to read it. If they do, the macro downloads a program that provides access to the workstation. The server files will only be encrypted later. If the attachment is removed on arrival, this chain never starts; if it gets through, everything depends on the reflex of not enabling the macro, and then on the backup.

The gateway acts on the first step. It does not see an intrusion through remote access, or an account already opened with a password stolen elsewhere. It restores nothing.

Cybermalveillance.gouv.fr recommends regular backups, offline copies, tested restores and updates applied without delay. It also recommends not paying the ransom. For your files, the question is covered in ransomware: protecting and restoring a document management system.

What remains a human action

  • Do not enable macros in a document received by email, even if it asks politely.
  • Do not enter a password on a page opened from a link you received; use the usual address or a bookmark. Cybermalveillance.gouv.fr also advises checking the site’s address, where a single character may differ.
  • Do not scan a QR code received by email to “sign in”.
  • Report a suspicious message rather than deleting it: the report helps the filter and warns colleagues.
  • Do not release a message you were not expecting from quarantine just to see what it is.

The limits of any analysis

  • A file encrypted by the sender: an archive protected by a password given in the message cannot be read by the filter. It is a known evasion technique; it is handled by a rule (quarantine, warning) rather than by content analysis.
  • A new malicious document with no known signature can get past the antivirus. The other signals (sender, context, macros) then take over, with no guarantee.
  • A compromised legitimate account sending a genuine but booby-trapped invoice benefits from the trust placed in the sender.
  • A link made malicious after the fact gets through if nobody rechecks it at the time of click.
  • An internal message exchanged between two mailboxes on the same email system, without leaving it, does not pass through a gateway placed in front: it is seen by the email system’s filter, or by no one.

Quarantine exists for doubtful cases: the message is neither delivered nor lost. See Quarantine, false positives and reports.

Frequently asked questions

Is a removed attachment lost?

The message arrives with a note explaining the removal. If the attachment was legitimate, the administrator or the recipient goes through the quarantine: see Quarantine, false positives and reports.

Can a PDF really be dangerous?

Yes: it can contain scripts or lead to a fake login page. That is why it is inspected like an Office document.

Why is a link checked yesterday blocked today?

The page has changed since delivery. Time-of-click protection assesses the page at the moment you open it.

Is a gateway enough to stop ransomware?

No. It reduces entry through email. Updates, remote access security and backups do the rest. See ransomware: protecting and restoring a document management system.

Where Klytic fits

How Klytic MTA splits these analyses between its two plans, as published:

AnalysisEssentialAdvanced
Antivirus and encrypted quarantineYesYes
Malicious Office macros and PDFsYesYes
Anti-phishing, brand impersonation, QR codesYesYes
Dangerous attachments removed, with an informational noticeYesYes
Secure release from quarantine and notificationsYesYes
Malicious HTML files and text hidden in imagesNoYes
Links rescanned at the time of clickNoYes

Klytic MTA works in front of any email system, without Klytic Mail. It does not replace the backup of your files and mailboxes: at Klytic, that is handled by the backups of the services themselves, described on the security and backup page.

Sources

Consulted in October 2026.

  • Cybermalveillance.gouv.fr, “Rançongiciel ou ransomware : que faire si votre organisation est victime d’une attaque ?” (Ransomware: what to do if your organization is attacked): definition, means of intrusion (vulnerabilities, remote access, phishing, malware), offline and tested backups, updates, do not pay. cybermalveillance.gouv.fr
  • Cybermalveillance.gouv.fr, “Que faire en cas de phishing ou hameçonnage ?” (What to do in case of phishing): check the address of a link and of the site before entering any information. cybermalveillance.gouv.fr
  • Klytic, Klytic MTA page: attachment and link analyses in the Essential and Advanced plans, options, deployment modes, activation via the MX record. klytic.com
  • ANSSI, “Guide d’hygiène informatique” (IT hygiene guide), version 2.0, September 2017, measure 24 “Protéger sa messagerie professionnelle” (Protect your business email): “Email is the main vector for infecting workstations” (translation). messervices.cyber.gouv.fr
  • ANSSI, MonServiceSécurisé, catalog of measures, measure “Mettre en œuvre une solution d’anti-spam et d’anti-hameçonnage” (Implement an anti-spam and anti-phishing solution): “Email systems are one of the main attack vectors since they are very widely used and exposed on the Internet” (translation). monservicesecurise.cyber.gouv.fr
  • ANSSI, “Recommandations relatives à l’interconnexion d’un système d’information à Internet” (Recommendations on connecting an information system to the Internet), ANSSI-PA-066, version 3.0, June 19, 2020, chapter 5 “Sécurisation du service de messagerie électronique” (Securing the email service): email “has become one of the main vectors of cyberattacks” (phishing, malicious attachments); § 5.2.3, anti-spam and malicious-content detection mechanisms “must be implemented” (translation). messervices.cyber.gouv.fr

Stop malicious attachments before the mailbox

Free 30-day trial of Klytic MTA, in front of your current email system.

Try Klytic MTA →

Compare Essential and Advanced

Further reading

Understand · Email securitySpam, phishing, malware and compromised accountsFour threats come through the same door and are not handled the same way. What gives each one away, what stops it, and why anti-spam alone is no longer enough.6 min readRead →Use · Email securityQuarantine, false positives and reportingWhat happens to a message held by Klytic MTA, how to release it, correct a false positive and report a malicious message.6 min readRead →Understand · Documents & document managementProtecting a DMS against ransomware, and restoring itPermissions that limit what an attacker can encrypt, a backup out of their reach, and a recovery sequence that does not depend on a single button.7 min readRead →

Welcome offer

30 days free trial, migration support included

No-commitment trial. An advisor calls you back to understand your needs and prepare your Klytic workspace.

🚀 Start the free trial See pricing