There are several ways in which attackers can spread malware using e-mails. Malicious code can be contained directly in an e-mail, for example. If an e-mail client is not configured correctly, it may execute the code when the e-mail is opened.

Files containing malware can also be sent as attachments to e-mails. If such e-mails are not sorted out by spam or virus filters and users open the attachments, the malware is executed. This can lead to extensive damage to other IT systems, as well—for example, if ransomware (also known as extortion trojans) is executed.