Detection blind spots: polyglot file formats in mass mailings and targeted attacks
Files built with the polyglot technique have been showing up more and more in cyberattacks in recent years. They let attackers slip malware past email filters and file scanners, deceive victims in phishing attacks, and complicate incident investigations. To pull this off, attackers deliberately construct a file that a system can interpret as different formats depending on which application opens it. A classic example is a file that can be handled as a PNG image or a ZIP archive. All it takes is changing the file’s extension, or simply using one or another application to open it. Let’s take a look at why it’s even possible to create files like this, which format combinations have turned up in real-world attacks, and how organizations can protect themselves from this threat. Why polyglot files are possible The data formats behind polyglot files are seldom exotic. It all comes down to a clever combination of common formats that happen to be structurally compatible. Polyglots exploit at least one of the following quirks in certain file formats: Most file formats need decoding from the very first byte, but some require to read them from the end. The clearest example is a ZIP archive: a corrupted or missing beginning doesn’t stop applications from reading the file, because all the needed headers actually sit at the end. This lets attackers simply glue two files together — in the example above, a PNG and a ZIP. The beginning reads as a valid PNG image, while the end reads as a valid ZIP archive. Many formats work like Russian matryoshka nesting dolls: despite outwardly having a specific extension matching its intended usage, inside the file is essentially a ZIP archive containing the necessary data. This group includes modern office documents (DOCX/XLSX/PPTX), Android installation packages (APK), Java library files (JAR), and many others. Some formats have no strict structural requirements — or their requirements are loose enough that the application that’s processing the file can locate the fragment it needs even when that fragment isn’t at the beginning. The Polydet GitHub repository describes numerous examples of possible file combinations for building a polyglot. Under the MITRE classification, this technique falls under the Masquerading category ( T1036.008 , Masquerade File Type). Examples of polyglot files in known cyberattacks Publicly available malware campaign analyses reveal all kinds of polyglots. Attackers adapt the entire attack scenario to fit a specific file type combination. The Head Mare group delivered the PhantomPyramid malware as a ZIP attachment. The file consisted of Windows executable code (EXE) with a small ZIP archive glued onto the end. When the victim opened the archive, it contained a file with the extension PDF.LNK, which would then launch that same polyglot attachment — this time as an executable file. In the attack documented by JPCERT , attackers created a file that started as a PDF and was detected as a PDF by most scanners but carried a DOC extension and opened in Office applications as a valid DOC file containing malicious macros. The attacks spreading the StrRAT and Ratty Trojans used a polyglot built from a signed Windows installer package (MSI) with malicious Java code (JAR) tacked onto the end. The StrelaStealer attacks used a polyglot with an HTML extension: a Windows library (DLL) with a decoy HTML document glued onto the end. A shortcut in the archive launched the file twice: once via the start command (the equivalent of a double-click, which opened a browser showing the HTML document), and once via rundll32 (which launched the malicious DLL). In a simulated but elegant attack, researchers joined two ordinary ZIP files together and found that different popular archive tools displayed the combined file differently: some showed only the first archive, some only the second, and some showed both at once as if it were a single archive with shared contents. If the attacker is familiar with the vic…
AI Analysis
Technical Summary
Polyglot files exploit structural compatibilities between common file formats to create a single file that can be interpreted differently by various applications. This is possible because some formats read headers from the end (e.g., ZIP), some formats are ZIP containers themselves (e.g., DOCX, APK), and some have loose structural requirements allowing partial parsing. Attackers use polyglots to bypass security filters and deliver malware via mass mailings or targeted attacks. Notable examples include PhantomPyramid malware using EXE and ZIP combined, PDF files with DOC extensions carrying malicious macros, and MSI installers appended with malicious JAR files. This technique is classified under MITRE ATT&CK as Masquerade File Type (T1036.008). The threat complicates detection and forensic analysis due to the file's dual nature.
Potential Impact
The use of polyglot files enables attackers to evade detection by security tools that rely on file type identification, increasing the likelihood of successful delivery of malicious payloads. It can lead to phishing attacks, malware infections, and more complex incident investigations. The technique allows attackers to deceive both automated systems and end users by presenting files as benign while containing malicious content. This can result in unauthorized code execution, data compromise, and persistence within targeted environments.
Mitigation Recommendations
No official patches are applicable as this is a technique rather than a software vulnerability. Organizations should enhance detection capabilities by using security tools capable of deep file inspection and heuristic analysis to identify polyglot files. User awareness training on the risks of opening unexpected or suspicious attachments is recommended. Incident response teams should consider polyglot files as a potential evasion method during investigations. Regular updates to email filtering and endpoint protection solutions may improve detection efficacy. There is no indication that this threat is already mitigated or requires no action.
Detection blind spots: polyglot file formats in mass mailings and targeted attacks
Description
Files built with the polyglot technique have been showing up more and more in cyberattacks in recent years. They let attackers slip malware past email filters and file scanners, deceive victims in phishing attacks, and complicate incident investigations. To pull this off, attackers deliberately construct a file that a system can interpret as different formats depending on which application opens it. A classic example is a file that can be handled as a PNG image or a ZIP archive. All it takes is changing the file’s extension, or simply using one or another application to open it. Let’s take a look at why it’s even possible to create files like this, which format combinations have turned up in real-world attacks, and how organizations can protect themselves from this threat. Why polyglot files are possible The data formats behind polyglot files are seldom exotic. It all comes down to a clever combination of common formats that happen to be structurally compatible. Polyglots exploit at least one of the following quirks in certain file formats: Most file formats need decoding from the very first byte, but some require to read them from the end. The clearest example is a ZIP archive: a corrupted or missing beginning doesn’t stop applications from reading the file, because all the needed headers actually sit at the end. This lets attackers simply glue two files together — in the example above, a PNG and a ZIP. The beginning reads as a valid PNG image, while the end reads as a valid ZIP archive. Many formats work like Russian matryoshka nesting dolls: despite outwardly having a specific extension matching its intended usage, inside the file is essentially a ZIP archive containing the necessary data. This group includes modern office documents (DOCX/XLSX/PPTX), Android installation packages (APK), Java library files (JAR), and many others. Some formats have no strict structural requirements — or their requirements are loose enough that the application that’s processing the file can locate the fragment it needs even when that fragment isn’t at the beginning. The Polydet GitHub repository describes numerous examples of possible file combinations for building a polyglot. Under the MITRE classification, this technique falls under the Masquerading category ( T1036.008 , Masquerade File Type). Examples of polyglot files in known cyberattacks Publicly available malware campaign analyses reveal all kinds of polyglots. Attackers adapt the entire attack scenario to fit a specific file type combination. The Head Mare group delivered the PhantomPyramid malware as a ZIP attachment. The file consisted of Windows executable code (EXE) with a small ZIP archive glued onto the end. When the victim opened the archive, it contained a file with the extension PDF.LNK, which would then launch that same polyglot attachment — this time as an executable file. In the attack documented by JPCERT , attackers created a file that started as a PDF and was detected as a PDF by most scanners but carried a DOC extension and opened in Office applications as a valid DOC file containing malicious macros. The attacks spreading the StrRAT and Ratty Trojans used a polyglot built from a signed Windows installer package (MSI) with malicious Java code (JAR) tacked onto the end. The StrelaStealer attacks used a polyglot with an HTML extension: a Windows library (DLL) with a decoy HTML document glued onto the end. A shortcut in the archive launched the file twice: once via the start command (the equivalent of a double-click, which opened a browser showing the HTML document), and once via rundll32 (which launched the malicious DLL). In a simulated but elegant attack, researchers joined two ordinary ZIP files together and found that different popular archive tools displayed the combined file differently: some showed only the first archive, some only the second, and some showed both at once as if it were a single archive with shared contents. If the attacker is familiar with the vic…
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Polyglot files exploit structural compatibilities between common file formats to create a single file that can be interpreted differently by various applications. This is possible because some formats read headers from the end (e.g., ZIP), some formats are ZIP containers themselves (e.g., DOCX, APK), and some have loose structural requirements allowing partial parsing. Attackers use polyglots to bypass security filters and deliver malware via mass mailings or targeted attacks. Notable examples include PhantomPyramid malware using EXE and ZIP combined, PDF files with DOC extensions carrying malicious macros, and MSI installers appended with malicious JAR files. This technique is classified under MITRE ATT&CK as Masquerade File Type (T1036.008). The threat complicates detection and forensic analysis due to the file's dual nature.
Potential Impact
The use of polyglot files enables attackers to evade detection by security tools that rely on file type identification, increasing the likelihood of successful delivery of malicious payloads. It can lead to phishing attacks, malware infections, and more complex incident investigations. The technique allows attackers to deceive both automated systems and end users by presenting files as benign while containing malicious content. This can result in unauthorized code execution, data compromise, and persistence within targeted environments.
Defensive Guidance
No official patches are applicable as this is a technique rather than a software vulnerability. Organizations should enhance detection capabilities by using security tools capable of deep file inspection and heuristic analysis to identify polyglot files. User awareness training on the risks of opening unexpected or suspicious attachments is recommended. Incident response teams should consider polyglot files as a potential evasion method during investigations. Regular updates to email filtering and endpoint protection solutions may improve detection efficacy. There is no indication that this threat is already mitigated or requires no action.
Technical Details
- Classification
- {"confidence":0.55,"severitySource":"default","classifier":"rss-v2"}
- Article Source
- {"url":"https://www.kaspersky.com/blog/polyglot-file-formats-attack-examples-detection-prevention-advice/56253/","fetched":true,"fetchedAt":"2026-08-10T14:37:42.294Z","wordCount":1722}
Threat ID: 6a79e236bf8831d539d9969c
Added to database: 08/10/2026, 14:37:42 UTC
Last enriched: 08/10/2026, 14:38:12 UTC
Last updated: 09/22/2026, 18:18:37 UTC
Views: 126
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.