A VHD, or Virtual Hard Disk, is a file format that stores the contents of a disk inside a single container. When mounted, it behaves like a real drive, letting the operating system read files and folders as if physical media had been attached. VHDs are common in virtualization, backups, and software deployment because they package an entire filesystem in a portable form.
In cyber security, VHDs matter because attackers can use them as delivery containers. A disk image may look less suspicious than a normal document and can sometimes bypass simple attachment filtering or user skepticism. Once opened, it can reveal a decoy file, a script, or a payload that launches the next stage of an intrusion. Defenders should inspect mounted images, monitor for unexpected drive mounts and child processes, and treat disk-image attachments as potentially executable content rather than harmless documents.