Managing malicious attachments

<body>
<p id="docs-hc-snippet" style="display: none;">Malware scanning is a security feature that scans all file attachments to tickets and messaging conversations and blocks any that are flagged as potentially malicious. In Agent Workspace, attachments from end users are scanned and, if flagged as malware, agents are prevented from downloading the file unless an admin oragent in a custom role with permissionsoverrides the malware identification. Additionally, in messaging channels, attachments from agents are scanned as well, and agents are prevented from submitting their comment until the file is removed or replaced.</p>
<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>

<div class="article-banner" id="suite_all">
<table>
<tbody>
<tr>
<td>
<strong>All Suites</strong>
</td>
<td>Team, Growth, Professional, Enterprise, or Enterprise Plus</td>
</tr>
</tbody>
</table>
</div>

<div class="article-banner" id="support_all">
<table>
<tbody>
<tr>
<td>
<strong>Support</strong>
</td>
<td>Team, Professional, or Enterprise</td>
</tr>
</tbody>
</table>
</div>

</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Summary: <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">Malware scanning checks all ticket and messaging attachments for threats, blocking flagged files from agents and end users. Admins or authorized agents can review and override restrictions on suspicious attachments. Agents' attachments are also scanned before sending, preventing submission if malware is detected. This feature helps maintain security by controlling access to potentially harmful files in support interactions.</p>
</div>

<div class="body">

<p class="p">Malware scanning is a security feature that scans all file attachments to tickets and messaging
conversations and blocks any that are flagged as potentially malicious. In Agent
Workspace, attachments from end users are scanned and, if flagged as malware, agents are
prevented from downloading the file unless an admin or <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408882153882" target="_blank">agent in a custom role with permissions</a> overrides the
malware identification. Additionally, in messaging channels, attachments from agents are
scanned as well, and agents are prevented from submitting their comment until the file
is removed or replaced.</p>
<div class="p">This article includes the following topics:<ul class="ul" id="topic_jyj_r25_xsb__ul_h5j_mf5_xsb">
<li class="li"><a class="xref" href="#topic_r5p_cg5_xsb">About malware scanning</a></li>
<li class="li"><a class="xref" href="#topic_ojg_dg5_xsb">Reviewing potential malware attachments from end users</a></li>
<li class="li"><a class="xref" href="#topic_kmw_c1k_z3c">Reviewing potential malware attachments from agents</a></li>
</ul>
</div>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_r5p_cg5_xsb">
<h2 class="title topictitle2" id="ariaid-title2">About malware scanning</h2>
<div class="body">
<p class="p" dir="ltr">Zendesk scans attachments to tickets and messaging conversations after they
are uploaded by the end user. When malware is suspected, agents can't access the
attachment, and end users won't see the attachment. Attachments are also scanned in
the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408846407066#topic_lmz_hkb_1vb" target="_blank">Zendesk Support mobile app</a> on both iOS and
Android.</p>
<p class="p">Whether agents see a notification about a blocked attachment and whether admins or
agents in custom roles with permissions can override the malware designation depends
on the Zendesk product, the agent interface in use, and the channel from which the
attachment originated. Specifically, warning labels are only displayed on
potentially malicious attachments if <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408832757146" target="_blank">email attachments are turned on</a> for the account and
agents are working in Agent Workspace or the Zendesk Support mobile app.</p>
<p class="p">In Agent Workspace:</p>
<p class="p">
<img class="image" id="topic_r5p_cg5_xsb__image_ytn_j1l_z3c" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/malware_detected-AW.png" width="500"></p>
<p class="p">In the Support mobile app:</p>
<p class="p"><img class="image" id="topic_r5p_cg5_xsb__image_mwz_fv4_jzb" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/support_mobile_malware_ios.png" width="300"></p>
<p class="p">If malware is detected in attachments to tickets created with the <em class="ph i">Submit a
request</em> link in the help center, the attachments are hidden from end
users.</p>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_ojg_dg5_xsb">
<h2 class="title topictitle2" id="ariaid-title3">Reviewing potential malware attachments from end users</h2>
<div class="body">
<p class="p">Malicious attachments to tickets and conversations are inaccessible to agents, but
admins and agents in custom roles with permissions can download the flagged
attachments and decide whether to allow agents to access them or keep them
restricted. Consult your company's security policy before downloading or taking
action on malicious attachments.</p>
<div class="p">
<strong class="ph b">To view a potential malware attachment</strong><ul class="ul" id="topic_ojg_dg5_xsb__ul_o3s_lbq_ysb">
<li class="li">In a ticket, click the download icon (<img class="image img-screenshot" id="topic_ojg_dg5_xsb__image_gxc_jrv_ysb" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/DownloadIcon.png">) on the potentially malicious attachment and
then click <strong class="ph b">Proceed</strong> in the confirmation dialog to download the
attachment.</li>
</ul>
</div>
<div class="p">
<strong class="ph b">To permit agents to access a flagged attachment</strong><ul class="ul" id="topic_ojg_dg5_xsb__ul_fq4_qbq_ysb">
<li class="li">After <a class="xref" href="#topic_ojg_dg5_xsb__ul_o3s_lbq_ysb">reviewing
the potentially malicious attachment</a>, under the attachment in the
ticket click <strong class="ph b">Allow access</strong>.</li>
</ul>
</div>
<div class="p">
<strong class="ph b">To restrict agent access to a flagged attachment</strong><ul class="ul" id="topic_ojg_dg5_xsb__ul_scz_rbq_ysb">
<li class="li">If you want to re-enable agent restrictions to a potentially malicious
attachment, under the attachment in the ticket click <strong class="ph b">Restrict
access</strong>.</li>
</ul>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title4" class="topic nested1" id="topic_kmw_c1k_z3c">
<h2 class="title topictitle2" id="ariaid-title4">Reviewing potential malware attachments from agents</h2>
<div class="body">
<p class="p" dir="ltr">When an agent attaches a file to a response in Agent Workspace, it is
scanned for potential malware as well. </p>
<p class="p" dir="ltr">An agent or admin will know their attachment is being scanned when:</p>
<ul class="ul" id="topic_kmw_c1k_z3c__ul_gls_21k_z3c">
<li class="li" dir="ltr">
<p class="p">A scanning progress bar appears at the bottom of the composer.</p>
<p class="p"><img class="image" id="topic_kmw_c1k_z3c__image_r4n_5mq_y3c" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/malware_scan_agent_attachment.png" width="400"></p>
</li>
<li class="li" dir="ltr">
<p class="p" dir="ltr">During the scan, the <strong class="ph b">Send</strong> button is greyed out and
unresponsive to agents.</p>
</li>
</ul>
<p class="p" dir="ltr"><strong class="ph b">If the attachment is found to be malicious:</strong></p>
<ul class="ul" id="topic_kmw_c1k_z3c__ul_hls_21k_z3c">
<li class="li" dir="ltr">
<p class="p" dir="ltr">An attachment failure message appears at the top of the workspace.
</p>
</li>
</ul>
<p class="p" dir="ltr"><img class="image" id="topic_kmw_c1k_z3c__image_avh_1nq_y3c" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/agent_malware_detected_growl.png" width="250"></p>
<ul class="ul" id="topic_kmw_c1k_z3c__ul_jls_21k_z3c">
<li class="li" dir="ltr">
<p class="p" dir="ltr">The <strong class="ph b">Send</strong> button remains unresponsive until the attachment is
removed from the composer. The agent can upload a different attachment and
try again.</p>
</li>
</ul>
<p class="p" dir="ltr"><strong class="ph b">If the attachment is deemed safe:</strong></p>
<ul class="ul" id="topic_kmw_c1k_z3c__ul_kls_21k_z3c">
<li class="li" dir="ltr">
<p class="p" dir="ltr">The attachment is displayed in the composer.</p>
</li>
<li class="li" dir="ltr">
<p class="p" dir="ltr">The <strong class="ph b">Send</strong> button is responsive, and the agent can submit
their message to the conversation.</p>
</li>
</ul>
</div>
</div>
<script id="docs-schema-markup" type="application/ld+json">{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/4483794022170-Managing-malicious-attachments",
"url": "https://support.zendesk.com/hc/en-us/articles/4483794022170-Managing-malicious-attachments",
"headline": "Managing malicious attachments",
"description": "You can manage potentially malicious attachments in tickets and messaging by reviewing flagged files, restricting or allowing access, and ensuring attachments are scanned before agents can download or send them.",
"articleSection": "Securing your Zendesk account",
"datePublished": "2022-03-22T16:02:27+00:00",
"dateModified": "2026-04-20T03:42:39.084005+00:00",
"inLanguage": "en-US",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/4483794022170-Managing-malicious-attachments"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"url": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"url": "https://support.zendesk.com/hc/en-us"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk"
}
}</script><script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>
</body>