File-Format Abuse Atlas

A code library that runs inside another process — abused by planting a malicious DLL a trusted, signed program loads for you.

A legitimately-signed but vulnerable kernel driver loaded on purpose to get kernel privileges and switch off security tools.

A shortcut whose target can be an arbitrary command line, letting a double-click launch PowerShell or cmd while showing an innocent icon.

The Android app package, sideloaded from phishing links and fake stores to deliver banking trojans and spyware.

A benign-looking HTML attachment that rebuilds a malicious file in the browser from embedded data, so nothing malicious crosses the network.

A tiny text shortcut that opens a URL — including WebDAV and SMB paths that fetch and stage remote payloads.

Windows library and saved-search files that can point Explorer at a remote WebDAV share and present remote payloads as if local.

macOS disk images and installer packages, the delivery vehicle for the fast-growing wave of macOS info-stealers.

A Microsoft Management Console snap-in file that, via an XSS in a console library, can run arbitrary script through mmc.exe.

One file that is simultaneously valid as two formats, so it passes as an image to a scanner and executes as code to an interpreter.

A phishing link hidden inside a QR-code image, which moves the victim to a personal phone outside corporate email and proxy defenses.

A Unix shell script, increasingly delivered as a copy-paste 'curl | bash' one-liner from a fake fix or install page.

An XML vector image that most gateways treat as a harmless picture, yet it can carry <script> that browsers execute on open.

A signed-looking installer that msiexec.exe runs with elevated trust, able to fetch and execute code during install.

Plain-text command and PowerShell scripts that run shell commands directly, the workhorse of loaders and fake-CAPTCHA lures.

A native Excel add-in DLL that runs code the moment it loads, behind a single 'Enable this add-in' prompt.

A trusted Windows binary (mshta.exe) runs HTML+script as a full application with no browser sandbox.

The native Linux binary format — the payload of choice for server intrusions, cryptominers and IoT botnets.

A Windows screensaver is just a renamed executable — double-clicking runs it like any EXE.

Loose scripts that wscript.exe / cscript.exe run directly on double-click, with full Windows Script Host access.

A CD/disk image that mounts as a drive on double-click and, until patched, did not propagate Mark-of-the-Web to the files inside.

A legacy Excel 4.0 macro sheet — predates VBA, runs on open, and long evaded tools that only inspected VBA projects.

A macro-enabled Office file that runs VBA on 'Enable Content' — the classic malware entry point before internet macros were blocked.

A notebook page that can embed any file as a clickable attachment, with no macro warning and weak default protections.

A document format that can embed OLE objects and remote templates, long used to trigger memory-corruption exploits with no macros.

A browser add-on that can read every page, cookies and keystrokes — abused via malicious, hijacked, or sideloaded extensions.

The universally trusted document — most weaponised PDFs are pure social engineering that hand off to a malicious link.

Python source or frozen executables carrying info-stealers, and malicious PyPI packages that run code the moment they install.

A modern signed app package that installs with a clean UI, abused via signed bundles and the ms-appinstaller URI.

A control-panel applet is a DLL that rundll32/control.exe loads and runs on double-click.

Saved email files that can nest attachments inside attachments and hijack real threads to smuggle payloads past scanners.

The dominant Korean word processor format, heavily targeted in espionage against Korea via embedded objects and font/EPS exploits.

A cross-platform Java program that runs via java -jar wherever a JRE is installed, favoured by commodity RATs.

A Linux launcher file whose Exec= line runs an arbitrary command, with a Name and Icon that can impersonate a document.

An archive with the password in the email body — content scanners can't open it, but the recipient can.

A Windows provisioning package that reconfigures a device on apply — able to add certificates, accounts, and run scripts.

A virtual hard-disk image that mounts as a volume and, like ISO, was used to smuggle payloads past Mark-of-the-Web.

A Windows imaging container that mounts like an ISO and was used as an alternative MOTW-bypass wrapper for payloads.

A Windows Sandbox configuration whose LogonCommand auto-runs on launch and whose MappedFolders can reach back into the host.

A desktop-theme file whose wallpaper or brand-image path can point at a remote SMB share and quietly leak NTLM credentials.

Developer-trusted XML that runs code: XSL stylesheets via msxsl/wmic and MSBuild project files via inline C# tasks.

A Windows help file that can embed active content hh.exe executes, an old but still-used script runner.

A one-line text file that tells Excel to pull data from a URL — and that URL can return a formula that runs a command.

Older archive formats abused via LOLBin extraction (CAB) and a notorious WinRAR path-traversal flaw (ACE).

The Publisher document format runs VBA macros and, unlike Word/Excel, long lacked the internet-macro protections attackers exploited.

A legacy DOS shortcut format that Windows will happily execute as a PE binary if one is renamed to .pif.

An XML scriptlet that regsvr32.exe can fetch from a URL and execute, the classic 'Squiblydoo' application-allowlist bypass.

A Windows settings-page XML file with a DeepLink field that runs an arbitrary command line.

A driver/setup script whose sections can be launched by signed LOLBins to run remote code.