IMMEDIATE ACTION Close the file. Do not enable macros, run scripts, enter credentials, or approve unexpected prompts. DO NOT DELETE EVIDENCE Keep the email and attachment available unless instructed otherwise. Support may need the original message for investigation. REPORT QUICKLY Open a support or security ticket and include the sender, subject line, time opened, attachment name, and anything the file asked you to do. WATCH FOR SYMPTOMS Report pop-ups, new browser tabs, strange login prompts, slow performance, antivirus alerts, or unexpected files. SAFER HABIT Unexpected attachments should be verified through a separate trusted channel before opening, especially invoices, shipping notices, resumes, spreadsheets, and compressed files.