I received a suspicious email at my business address with the subject "ACH payment." The sender's address and claimed company seemed odd, and another person copied on the message didn't appear to work for that company. I expected a PDF attachment, but after downloading it I realized it was an HTML file. I opened it briefly, but closed the webpage before it finished loading. I then deleted the file and emptied the trash. The email later disappeared from my inbox.
Could opening the HTML attachment have installed malware or exposed my email credentials? My email requires approval through an authenticator app, so I'm also wondering whether an attacker could bypass that protection or steal an active login session. What steps should I take now, and should I report this to my company's IT department?
3 Answers
Tell your company’s IT or security team right away, especially because this involved a business mailbox. They can inspect mail logs, check whether the message was recalled or quarantined, and look for unusual sign-ins or active sessions. From a trusted device, change your email password, sign out of other sessions, and review your multifactor authentication methods and recent account activity. Authenticator-based MFA is helpful, but it can’t protect an already-stolen session token or credentials in every scenario.
The message has several classic phishing signs: an unexpected payment topic, a mismatched sender, a strange attachment type, and an unrelated person copied in. Don’t share the company names publicly if they include private information; instead, report the message through your workplace’s phishing process or to the legitimate company being impersonated. If you typed a password into the page or approved an unexpected login, treat the account as compromised and escalate immediately.
There is some risk, but opening an HTML file does not automatically mean your Mac was infected. These attachments commonly lead to fake login pages or try to exploit an outdated browser. Since you closed it quickly, didn’t enter credentials, and deleted the file, the situation is less concerning, but you should still update macOS and your browser, run a reputable security scan, and check your browser’s downloads and saved data. Don’t use the suspicious email or attachment again.
I didn’t enter a password or approve an authentication request, so hopefully that limits the exposure. I’ll still contact IT, update everything, and review the account’s sign-in history.