Gmail will block JavaScript attachments, a common source of malware

Starting Feb. 13, Google will no longer allow JavaScript attachments on its Gmail service, killing one of the main methods of malware distribution over the past two years.

Users will no longer be able to attach .JS files to emails in Gmail, regardless of whether they attach them directly or they include them in archives like .gz, .bz2, .zip or .tgz. For those rare cases when such files need to be shared via email, users can upload them to a storage service like Google Drive and then share the link.

The .JS file extension will be added an existing list of other banned file attachments that includes: .ADE, .ADP, .BAT, .CHM, .CMD, .COM, .CPL, .EXE, .HTA, .INS, .ISP, .JAR, .JSE, .LIB, .LNK, .MDE, .MSC, .MSP, .MST, .PIF, .SCR, .SCT, .SHB, .SYS, .VB, .VBE, .VBS, .VXD, .WSC, .WSF and .WSH. Most of these file types have long been abused by cybercriminals to send malware via email.

The same thing has happened with .JS over the past two years, especially since JavaScript files can be executed directly on Windows thanks to a system component called the Windows Script Host (WSH).

The JavaScript files, which are typically obfuscated, can serve as downloaders for other malware and have been especially preferred by ransomware pushers. Widespread threats like TeslaCrypt and Locky have used this method of distribution and one particular ransomware program dubbed RAA was written completely in JavaScript.

“Be wary of emails with JavaScript attachments,” researchers with Microsoft’s Malware Protection Center warned in a blog post in April. “It is uncommon and quite suspicious for people to send legitimate applications in pure JavaScript file format (files with .js or .jse extension) via email. Do not click or open it.”

Other scripting files like .VBS (VBScript), .VBE (VBScript Encoded), .WSH (Windows Script Host Settings File) and .WSF (Windows Script File) — all of which Gmail already blocks — can be used in a similar way.

The general rule is that if you don’t recognize a file type and don’t know what it does, you should never open it. If you are expecting files in unusual formats, you should always double check the source before opening them and it would be best not to share them via email.