Automatic Malicious Download Scanning: How SecureLint Checks Files Before You Open Them

You receive an email with an attached invoice PDF. You click download. The file lands in your Downloads folder. You open it — and it executes a hidden macro that installs a remote access trojan. The entire attack chain takes less than 30 seconds and bypasses every security control that operates outside the browser.

SecureLint's automatic download scanning intercepts every file download and evaluates it across multiple risk signals before it completes. When a file is flagged, a warning notification appears before the file opens — giving you the information you need to make a safe decision.

Why file downloads are a top attack vector

Malware delivered via file download remains one of the most effective attack techniques because it is deceptively simple. Attackers use several evasion approaches:

• Legitimate cloud hosting — Hosting malicious files on Google Drive, Dropbox, OneDrive, or AWS S3 means the download URL passes domain reputation checks because the hosting domain is trusted.
• Extension spoofing — A file named invoice.pdf.exe with Windows file extensions hidden appears as invoice.pdf to most users. Renaming a .js file to .docx and compressing it in a ZIP passes many automated scanners.
• Password-protected archives — Zip files with a password prevent automated content scanning because scanners cannot open the archive without the password. The password is usually included in the email body, which a human reads but automated tools cannot act on.
• Macro-enabled Office documents — Office files with embedded VBA macros are the most common initial access vector in enterprise environments. The malicious code only executes when the user enables macros — a user action that bypasses file scanning.
• ISO and disk images — ISO files mount as virtual drives and bypass Windows Mark-of-the-Web (MOTW) protections that normally warn users about files downloaded from the internet.

How SecureLint scans downloads in real time

SecureLint hooks into the Chrome downloads API, which provides metadata about every file download including the file URL, referrer, MIME type, filename, and file hash once the download completes. The scanning pipeline runs four checks in parallel:

1. File hash reputation — The SHA-256 hash of the downloaded file is checked against SecureLint's threat intelligence database of known-malicious file hashes. This lookup takes under 200 milliseconds and catches known malware samples.
2. Source domain analysis — The download URL's domain is evaluated using SecureLint's domain risk engine: age, SSL certificate, category (phishing, malware distribution), and hosting reputation.
3. MIME type vs. extension mismatch — The server-declared Content-Type is compared against the file extension. A mismatch (e.g., Content-Type: application/octet-stream for a file named document.pdf) is a red flag for disguised executables.
4. High-risk file type scoring — Executable and script file types receive a base risk score that increases when combined with a young source domain or a recently-seen hash.

File hash reputation checks

The most reliable signal for known malware is its cryptographic hash. SecureLint maintains a hash database populated from multiple threat intelligence feeds including:

• VirusTotal community detections (aggregated from 70+ antivirus engines)
• MalwareBazaar open-source malware repository
• SecureLint's own internal malware sample collection
• CISA Known Exploited Vulnerabilities catalogue file hashes

Source domain reputation analysis

Where a file comes from is as important as what the file contains. SecureLint evaluates the download source domain using the same real-time signal engine as its phishing website protection:

• Domain age — A newly-registered domain serving a file download is a strong malware distribution signal
• Hosting reputation — Domains hosted on infrastructure known for malware distribution receive a high base risk score
• Category flags — Domains already categorised as Malware Distribution, Phishing, or Suspicious Content trigger an immediate high-risk warning
• Redirect chain — The full redirect chain from the original download link is evaluated, not just the final URL

MIME type and file extension mismatch detection

Attackers routinely disguise dangerous file types by giving them benign extensions. SecureLint compares the server-declared MIME type against the actual file extension for every download:

• A file served as application/x-executable but named report.pdf — flagged as disguised executable
• A .zip file served with Content-Type: image/jpeg — flagged as disguised archive
• A .js file renamed to .txt — flagged as disguised script
• A .docm file (macro-enabled) inside a zip — flagged as high-risk Office document

High-risk file types SecureLint flags automatically

• Executables — .exe, .msi, .dmg, .pkg, .deb, .rpm, .appimage
• Scripts — .js, .vbs, .ps1, .bat, .cmd, .sh, .hta, .wsf
• Macro Office documents — .docm, .xlsm, .pptm, .xlsb
• Disk images — .iso, .img, .vhd, .vmdk (bypass Windows MOTW)
• Password-protected archives — .zip, .rar, .7z with detected password-protection headers
• Shortcut files — .lnk, .url (commonly used in phishing kits to execute remote payloads)

Setting up download scanning in SecureLint