A weaponizable file is a file type that attackers commonly abuse to deliver malware, run scripts, or exploit trust in a platform. Examples often include document formats with macros, archives, executables, shortcuts, and other extensions that can carry active content or hide malicious payloads. The file itself is not always harmful, but its format makes it easy to turn into a delivery vehicle.
This matters because many defenses still rely on file type controls. Email gateways, chat platforms, and endpoint tools may block or warn on weaponizable extensions to reduce risk. In attacks, adversaries send these files through attachments, links, or shared folders to get a user to open them. In defense, teams use blocklists, content scanning, sandboxing, and strict policy settings to limit exposure, but extension checks alone are coarse and can miss harmful content in permitted formats.