Spot a suspicious macro-enabled download
A macro-enabled attachment can carry code that runs when macros are enabled, even when its name looks ordinary. The strongest warning sign is often a combination of factors: an unexpected file, a sender domain that does not match the organisation, and a download link pointing somewhere unfamiliar. Treat that combination as suspicious rather than judging from the display name alone.
The sender domain and download domain are separate checks. The first sits after the @ in the From address; the second is the host in the URL delivering the file. Inspect a suspicious link in a plain-text editor without clicking it. Many Australian teams use Microsoft 365 and Xero, with SharePoint and OneDrive links in routine workflows, so familiarity with cloud links should not create blanket trust.
Australian users may also see impersonation of Australia Post, Woolworths, the Australian Taxation Office or a major bank. A legitimate .com.au or .au sender is not automatically dodgy, but it does not make the attachment safe. Compare identity, file type, destination and authentication before anything executes.
Separate the sender from the download
Read the sender line and Reply-To address, not just the display name. Note the exact registrable domain and compare it with addresses the organisation normally uses. Legitimate Microsoft 365 senders may use an organisation-named onmicrosoft.com tenant, so verify the known tenant rather than reject every unfamiliar format. Look for lookalike spellings, unexpected subdomains, encoded characters or a reply-path mismatch. A sign-off such as “cheers” proves nothing.
Then inspect the URL host that delivers the file. A company.sharepoint.com address may be routine, while a tiny lookalike or newly registered domain is not, although neither fact alone proves safety. Shorteners and redirect chains deserve extra care. A guide to using domain reputation data explains how to rank unfamiliar hosts before anyone downloads. Compare the registrable domain, not the promotional words before https:// or the path.
| Signal | Lower concern | Higher concern |
|---|---|---|
| Sender domain | Known organisation address | Lookalike, reply-to mismatch or unverified tenant |
| Download host | Expected company or approved cloud tenant | New domain, redirect chain or unrelated host |
| File format | Matches the stated task | Macro-enabled or double extension |
| Message context | Routine document or invoice | Urgency, password request or gift-card demand |
Inspect the attachment and its delivery
Macro-enabled Office files often use extensions such as .docm, .xlsm, .pptm, .dotm and .xlam. Their presence is not proof of malware, but a spreadsheet that should be a .csv or a form that should be a .docx warrants a closer look. Double extensions such as invoice.pdf.js, archive.zip.exe and mismatched file icons are strong warning signs.
Check how the file is delivered as well as its name. A message saying “Your document is ready” but requiring you to download an executable from a personal storage account has created a mismatch. Confirm the expected file and host through a known phone number or existing team chat, not by replying to the message. Keep the original email for security staff to examine.
Verify authentication and domain trust
Sender authentication adds another layer. SPF identifies domains permitted to send for a mail host, DKIM signs outbound messages, and DMARC connects those results to the visible sender domain while specifying how failures should be handled. A valid DMARC result is useful, but it is not a cleanliness certificate: a compromised legitimate mailbox can still send harmful content.
Fresh practical DMARC guidance explains alignment and failures across common mail services. Authentication belongs to the sender domain; it does not authenticate an unrelated download host. For the latter, check reputation, domain age, certificate details and known malicious activity. Neither signal replaces safe handling.
Trusted Sender Score provides free sender and domain checks, while bulk domain checking and an API suit organisations screening many inboxes. Run checks on both the visible sender domain and the download host. Record the result and analyst decision so the same warning is not rediscovered from scratch next week.
Download without giving the file control
Do not enable macros, click “Enable Content” or preview the file on a device with privileged access. Download only after the URL and sender have been validated, then use a managed sandbox or isolated analysis environment. Keep endpoint protection and email scanning enabled, but do not assume they will catch every obfuscated payload.
When business files arrive by email, give teams a simple reporting route without embarrassment. Small businesses in Sydney, Melbourne and Brisbane often have lean IT functions, so a shared quarantine mailbox and escalation checklist can work better than expecting everyone to diagnose a macro. Preserve the original email, URL, file hash and receipt time for later investigation.
Contain exposure and improve controls
If the file was opened or macros were enabled, isolate the device from the network and notify the internal security contact immediately. Do not delete the sample or unrelated logs. Record what was launched and whether credentials were entered. From a clean device, reset affected passwords, revoke active sessions and check for suspicious sign-ins, forwarding rules and mailbox changes.
Report relevant incidents through ReportCyber or Scamwatch, especially when money or identity details are involved. If a bank is impersonated, contact its fraud line using the number on the official website. For recurring threats, a domain trust score policy provides documented thresholds for quarantining, escalating or allowing a sender rather than relying on memory.
The result is a repeatable control: identity and link checks happen before download, macros remain disabled unless policy permits them, and incidents produce evidence that improves the next decision. That protects Australian teams without treating every attachment as dangerous.