Healthcare workers frequently preview attachments to determine whether they can trust an email. The practice can be safer than downloading a file and then opening it in its native application; however, it still presents some risk.

According to a study on the prevention and mitigation measures against phishing emails, “Malware can be disguised as an attachment or a URL in phishing emails.” As such, a benign-looking Word document, invoice, photo, or spreadsheet could actually be part of an attack. HIPAA compliant email scanning can review attachments before they reach an inbox to quarantine suspect emails and provide more context to authorized reviewers. Rather than relying on an employee's quick assessment to review attachments, providers can take more time to research suspicious files.

There are times when previewing will put users at risk. If the email client, browser, OS, or attachment previewer has a vulnerability that the file exploits, then opening the preview will cause danger. A properly designed and patched preview subsystem can minimize this risk by disabling active content, restricting network access, or rendering the file in a sandbox.

 

Will previewing an attachment result in malware infection?

The study Dynamic Feature Dataset for Ransomware Detection Using Machine Learning Algorithms notes, “The most common delivery system for ransomware is … email attachment and phishing techniques.”

Attachments come in many formats. An attachment preview is not always limited to displaying a screenshot. Windows previews may invoke a parser to read the file format and render its contents for viewing. Parsing the file requires processing and can present a potential attack surface.

Malware authors could craft a file that exploits a vulnerability in the preview parser. Successful code execution could occur without the user’s double-click or enabling macros. Last year, Australia’s Cyber Security Centre reported CVE-2024-21413 targeted the Microsoft Outlook Preview Pane and could bypass Office Protected View. Potential exposure varies by product, file format, configuration settings, and patch level.

 

How do attachment previews parse files?

Another study explains, “A distributed framework for zero-day malware detection using federated learning and deep neural networks.” Dynamic analysis refers to the automatic execution of malware samples inside a sandbox or a controlled environment to monitor their behavior.

Sandboxing is a type of dynamic analysis that executes a suspicious file in an isolated location. The idea is to prevent malware from reaching regular networks and systems while security software detects what it does.

Email attachment previews don’t always operate like this. Some previews render files inside of a browser. Others launch a program that’s installed to handle previews. Windows Office also creates a safe preview of the document.

Microsoft notes that Outlook’s previewer uses Protected View, which is in essence a sandbox. Moreover, AppContainer strengthens isolation and also blocks the previewer from accessing the network. Microsoft adds that scripts, macros, and ActiveX controls are turned off during previews.

 

Risks associated with email attachment previews

Cybersecurity risks change constantly, so no solution is entirely risk-free. However, risky previewing practices can be improved with secure alternatives. Cyberattacks remain a permanent and substantial threat to healthcare organizations, according to an article on cyberattacks. The article outlines a ransomware attack that started when one employee opened a spreadsheet compromised with malware from an email attachment. Attachment opens affect the user’s device and connected shared drives, billing systems, and clinical applications.

Unsafe attachments often require additional user interaction to release their payloads. These types of attacks are mitigated by modern safeguards because most macros and scripts will prompt the user to enable content from malicious websites. Vulnerabilities with previewing target the program used to read the file. CVE-2024-21413 demonstrated why software should be kept up to date even if staff are educated not to open unknown attachments.

Also, opening an attachment is not safe just because antivirus scans are clean. According to the CISA, users should not open a suspicious attachment even if their antivirus software says it is clean because attackers are constantly releasing new variants of malware and exploiting previously unknown vulnerabilities.

 

Providing secure previews without downloading attachments

A BMC study notes “the ability to identify suspicious emails, recognise phishing attempts, and understand best practices for data handling.” Employees should have enough information to decide, but downloading an unknown email or attachment can put your systems at risk. Keeping the message out of users’ inboxes while it is being reviewed keeps both data and people safer.

Security does not have to end when an admin has rendered their judgment. A secure quarantine preview can analyze and display a file’s sender, classification, headers, file type, and visible content without download. Once it is in quarantine, supported files should be previewed securely inside the browser or a locked-down service that cannot access local files. Ideally, files are identifiable by their contents rather than their file extension. Providers should research how their quarantine preview features process files because not every solution works the same.

 

What healthcare organizations should do

Researchers conducted a study of simulated phishing emails sent to over 2.9 million email addresses across six hospitals. Their results showed an overall median click rate of 16.7%.

User awareness is necessary, but technology should prevent risky decisions from reaching the user as often as possible.

Paubox’s 2026 Healthcare Email Security Report analyzed 170 healthcare email-related breaches disclosed in 2025. The report’s accompanying survey of over 300 healthcare IT leaders revealed 65% of organizations use basic spam filters as their primary defense against email-based attacks. Basic filtering does not provide the same protection as layered attachment inspection, sender authentication, behavioral analysis, and controlled quarantine review.

Healthcare organizations can take the following steps:

  • Updating operating systems, browsers, email clients, Office applications, PDF readers, and preview handlers to versions that are supported and fully patched.
  • Scanning attachments prior to delivery and quarantining suspicious emails instead of depositing them in a user’s inbox.
  • Blocking or restricting executables, scripts, macro-enabled documents, and other unnecessary file types.
  • Using a malware-scanned and controlled preview when available. Never preview files already identified as malware.
  • Restricting who has access to quarantine based on role. Requiring multi-factor authentication to access quarantined emails, and logging all administrator actions.
  • Training users to verify unexpected files using a separate channel, like a phone call, and how to report suspicious emails without forwarding to anyone.
  • Performing a thorough risk analysis that includes HIPAA’s access control requirements.

 

FAQs

Is previewing an attachment the same as opening it?

No. A preview normally uses a limited viewer instead of launching the file's full application, but the previewer still processes the file and may contain exploitable vulnerabilities.

 

Can previewing a PDF expose a user to malware?

Yes, if the PDF is specially crafted to exploit a flaw in the browser, PDF renderer, or preview handler. A patched and sandboxed preview reduces this risk but cannot remove it entirely.

 

Can a Microsoft Office macro run during an Outlook preview?

Microsoft states that scripts, macros, and ActiveX controls are disabled during Outlook attachment previews. Healthcare organizations should still patch Office because a malicious document may target the previewer itself rather than rely on a macro.

 

Is a quarantined attachment safe to preview?

Not automatically. Administrators should check the quarantine reason and use only the platform's supported preview workflow; attachments classified as malware should remain blocked and should not be downloaded to a normal workstation.