Dive Brief:

• Google announced Gmail will begin automatically blocking JavaScript (.js) file attachments starting February 13, 2017, according to a Google blog.

• Gmail already restricts several other file attachments, including .msc and .bat, for security reasons.

• Google said for inbound mail, senders will get a bounce message stating why the email was blocked. Users that have a legitimate need to send .js files can still do so but must use Google Drive or similar tools instead of Gmail.

Dive Insight:

Google is making the move to help secure its user base. As Naked Security notes, there has been an increase in ransomware stemming from from malicious JavaScript attachments. While ransomware can enter a network in a number of different ways, JavaScript email attachments are added on to help unleash the malware and lock down a network. 

Companies may want to ensure their employees are aware of the dangers of JavaScript attachments as part of their overall IT security training. In general, unless the sender is known, it is best to avoid opening unexpected email attachments.