How to spot a disguised download
A disguised download is a harmful program dressed up to look like a safe, ordinary file such as a document or an image.
The trick behind a disguised download
Most people relax when they see a familiar file. A PDF invoice, a photo, a spreadsheet. These feel harmless. Attackers know this, so they build a program and give it the look of a safe file. When you open it, you think you are viewing a document. In truth you are running software that a stranger wrote.
The disguise usually works in one of two ways. The file uses a name and an icon that suggest a document while the real type is a program. Or the download starts on its own from a page you did not ask, hoping you will open whatever lands in your downloads folder.
Check the real file type
The safest habit is to look past the icon and the first part of the name. Focus on the true ending of the file.
- Watch for a double ending. A file named report.pdf.exe is a program, not a PDF. Your computer only cares about the last ending, which here is exe.
- Learn the endings that run code. On Windows these include exe, scr, bat, cmd, com, msi, and js. A document should not end in any of those.
- Be careful with archives. A zip or rar file can hide a program inside. Opening the archive is fine. Running what is inside without checking is the risk.
- Turn on file extensions in your system settings so the ending is always visible. Hidden endings are how the double-ending trick survives.
- Notice the size. A one-page PDF that arrives as a large file, or a video that is only a few kilobytes, does not add up.
Check where it came from
Where a file starts matters as much as what it claims to be.
- Prefer the maker. Download apps from the official site or the built-in store, not from a random mirror or an ad.
- Be wary of downloads that begin without a click. A page that pushes a file at you the moment it loads is a warning sign.
- Treat email attachments with care. An unexpected invoice, receipt, or resume from someone you do not know is a common way malware spreads.
- Look at the address you are downloading from. A brand name buried inside a longer domain, like update-adobe-viewer.net, is not the real brand.
- Slow down when a message rushes you. Urgency is a tool to stop you from checking.
How to protect yourself
You do not need deep technical skill to stay safe. A few steady habits do most of the work.
- Show file endings and read the true ending before you open anything.
- Do not open a file you did not expect, even from a name you recognize. Ask the sender through a separate channel first.
- Keep your browser and system updated so known holes stay closed.
- Scan a file you are unsure about with your security software before opening it.
- When in doubt, delete it. A file you do not open cannot harm you.
A tool can catch the disguise for you. Fish Catcher is a free, open-source browser extension with a download guard that warns you when a download does not match what it claims to be, such as a program pretending to be a PDF. The check runs on your device, and nothing about the file leaves your browser by default. It warns you in plain language and never blocks the download. You decide whether to keep it or throw it away.
Common questions
The file has a document icon. Doesn't that prove it is a document?
No. An icon is just a picture attached to the file, and any file can carry any icon. Attackers set a document icon on a program on purpose. Trust the true file ending, not the picture.
Is it dangerous to download a file, or only to open it?
Downloading a file to your computer is usually harmless on its own. The risk comes when you open or run it. That pause between download and open is your chance to check the ending and the source.
A file downloaded by itself when I visited a page. What should I do?
Do not open it. A download you did not start is a warning sign. Delete it from your downloads folder. If you are unsure whether it ran, scan your computer with your security software and change important passwords from a device you trust.