A disk-image attachment is a file container that behaves like a virtual drive. Common examples include VHD or ISO files. When mounted, it can expose folders and files inside the image, even though the outer attachment may look like a single, ordinary file.
This matters in cyber security because attackers use disk images to make malicious content look less suspicious than a normal document attachment. A user may be more willing to open a disk image than a macro-enabled Office file, and some filters or sandboxes may inspect it differently. In targeted phishing, the image can carry a decoy document plus a second-stage payload, helping the operator separate the lure from the malware. Defenders should inspect mounted images, watch for unusual process launches after a file is opened, and treat disk-image attachments from email or messaging with the same caution as executable content.