Attachment opens are tracked by a small tracking image placed within the attachment. If that image is allowed to load (i.e. the user opens the file), then your console will report the attachment as being opened.
For macro attachments, the file is "beaconized" and will "call home" to our servers when the macro is enabled, and the enabled macro will be recorded in your phishing campaign results.
Note:We have changed how our PDF attachments work. We've discontinued using JavaScript beacons in PDF attachments because Microsoft Defender and potentially other security tools were blocking them. Instead, opens are recorded when users click on links embedded within the PDF documents. For more information, see our Phishing Campaign Attachments Overview article.
Why are my attachments not showing as open?
If you have conducted an attachment phishing test and you find your results to potentially be inaccurate, then the following may be occurring:
- Your user must open the attachment in its native program in order for it to be tracked. If your user does not open the attachment in its native program, the attachment open won’t be recorded. The native programs include Adobe for PDF attachments, Excel for .XLS attachments, Word for .DOC attachments, and so on.
- If your users are only using a preview method to look at the attachment, this may not count as an opened attachment.