Where document attacks are heading by 2030

If you’ve been watching malicious documents for a while, you’ll have noticed something odd: the file types keep changing, but the attacks don’t, really. Macros get blocked, so it’s ISO files. Those get marked, so it’s OneNote. Then HTML smuggling, then shortcuts, then SVG. Every time the industry closes a door, the same attack walks in through a different one wearing a different hat.

That’s the single most useful thing to understand about where this is going. It isn’t a story about formats at all. It’s a story about capability displacement — attackers keep the effect they want and move the chain into whichever feature, carrier or consumer is currently cheapest.

So rather than another list of scary file extensions, here’s what’s actually driving the next few years, what plausibly happens by 2030, and what stays true regardless.

The drivers

The unit of attack stopped being a file. It’s a delivery graph now: email → link → encrypted archive → disk image → shortcut → script → cloud-hosted payload. Every hop is an opportunity to shed an origin label, change which scanner sees the content, or hand execution to a trusted operating-system component. If your controls reason about “the attachment”, they’re reasoning about one node in a chain.

Plenty of attacks no longer carry code. Credential phishing, session-token theft, adversary-in-the-middle login pages, QR codes, fake e-signature workflows, business email compromise — none of these need malware in the document. The document’s job is to be persuasive and to route you somewhere. It authenticates the story rather than executing the payload. This is already the majority pattern in a lot of enterprise channels, and the gap is likely to widen.

Documents now have more than one audience. The same file gets previewed, transcoded, OCR’d, indexed, summarised, chunked into a retrieval system and handed to a tool-using agent. That’s not one consumer, it’s five or six — and they don’t all see the same thing. Content can carry one message to the human reading it and a different one to the model ingesting it. Disagreement between consumers is the attack surface.

Automatic preprocessing quietly expanded the blast radius. Every convenience feature that decodes untrusted content before a person decides to trust it — preview panes, transcription, thumbnailing, indexing, multimodal summarisation — is another parser reachable without a click. Sandboxing helps, but the number of reachable decoders keeps going up.

AI is mostly an accelerant, not a new weapon. Through 2026 the well-evidenced effect is speed: reconnaissance, translation, lure writing, code development, obfuscation, campaign iteration. Genuinely AI-dependent malware exists but isn’t the dominant pattern. The realistic 2030 story is faster cross-format mutation and adaptive delivery, not a world of autonomous malware.

What that means by 2030

A few of these feel near-certain, and it’s worth separating them from the maybes.

Carrier rotation gets automated. Campaign tooling will pick between PDF, HTML, SVG, Office, archive, shortcut and cloud-share paths based on the target’s platform and what just failed. The capability graph stays stable while the surface syntax churns. The tell: sibling samples in different formats with identical execution or credential chains, and a much shorter gap between a vendor mitigation and the migration around it.

Exact signatures rot faster; structure holds. Strings, hashes, filenames and lone metadata fields get cheaper to mutate every year. What survives is relationships — document → user action → interpreter, archive → shortcut → script, retrieved instruction → tool call. If your detection is anchored to surface trivia, expect its half-life to keep shrinking.

AI ingestion becomes an ordinary security boundary. Organisations are indexing email, tickets, reports, meeting notes and repositories into assistants. Indirect prompt injection stops being a red-team curiosity and starts appearing in normal application threat models — and in incident reports, where hostile external content changed a recommendation, a stored memory or a tool call.

Attacks split across representations. If you inspect channels one at a time, attackers will spread a single instruction across visible text, OCR output, image content, metadata and annotations. Each channel looks harmless alone; the meaning only assembles inside a model that reads several at once. These are nasty precisely because removing any one piece makes the attack disappear during analysis.

Provenance gets valuable, and therefore gets attacked. Content credentials, signatures and producer fingerprints will spread as synthetic content scales. The response won’t be crude metadata forgery — it’ll be stolen signing keys, compromised creation services, partial signature coverage and coherent-looking false histories. A valid signature over a misleading claim is a harder problem than an obviously forged one.

Analysis budgets become a target. If a scanner gives up after N objects, M pages or a certain token count, that limit is a place to hide. Expect payloads tuned to sit just past common limits, and variants shaped to different vendors’ budgets. This one worries me more than it probably should, because a budget-exhausted scan often reports identically to a clean one.

Fraud and intrusion converge. The toolchain that produces a convincing invoice also produces convincing supplier correspondence and identity records. Fraud teams and security teams will increasingly be looking at the same documents, generated by the same infrastructure, for different reasons.

And a negative forecast worth holding onto: fully autonomous end-to-end campaigns probably stay a minority by 2030. Agents will handle recon, variant production, delivery testing and routine post-compromise work — but humans tend to stay in the loop for objectives, targeting, payment and recovering from ambiguous failure. Partial autonomy at every stage still lifts campaign tempo enormously, which is the part that should worry you.

Three ways 2030 could look

Accelerated displacement (~55%). The boring, most likely one. AI industrialises existing tradecraft. Credential and user-executed chains keep growing. Prompt injection becomes a standard residual risk you manage rather than eliminate. Parser exploits stay concentrated in high-value operations and neglected systems. Provenance adoption is real but patchy.

Adaptive content operations (~25%). Agents reliably test delivery against live controls and rotate carriers on their own. Multimodal injection and retrieval manipulation become commodity services. Synthetic evidence packs make supplier and identity fraud genuinely hard to adjudicate. Compromised generation or provenance services give attackers trusted distribution at scale.

Platform controls dominate (~20%). Memory-safe rewrites and fast patching shrink the reachable parser classes. Passkeys and transaction-bound authorisation take the profit out of credential theft. Agent platforms enforce tight tool capabilities and action confirmation. Content normalisation and representation comparison become routine at ingestion.

The important caveat: these aren’t mutually exclusive — they’re distributed by sector. A large cloud tenant may genuinely be living in the constrained scenario while a regional council, a healthcare appliance vendor or a small supplier in the same supply chain is squarely in the accelerated one. The divide between the two is likely to widen, and attackers will keep aiming at the lagging side.

What doesn’t change

Strip away the format churn and a short list survives:

• attackers take the cheapest reliable path to execution, access, money or influence;
• trusted business workflows beat exotic formats, because you can’t simply block them;
• content self-description is useful to attackers precisely because downstream systems keep trusting it;
• nested boundaries and consumer disagreement create durable evasion;
• surface features change far faster than intent, data flow and external effect;
• and incomplete analysis is never evidence of absence.

That last one is the one I’d tattoo on things. Encrypted, truncated, over-budget, unsupported or failed content is not clean content — but an awful lot of tooling reports it the same way.

So what do you actually do

Nothing exotic, but it does mean changing the shape of the question:

Treat the content graph as the unit of risk, not the attachment. The root asset, every nested member, every accepted interpretation, every derived representation.

Normalise capability across carriers. Execution, credential capture, disclosure, persistence, coercion — if your control only recognises one wrapper, a repackage defeats it.

State coverage honestly. Scope negative conclusions to what you actually analysed, and let gaps influence whether content gets released, indexed or handed to an agent.

Compare representations instead of picking a winner. Visible render, extracted text, OCR, metadata and model-ready chunks answer different questions, and their disagreement is itself evidence.

Treat metadata as a claim, with an authority level. Filename, MIME type, author, timestamps and producer strings are attacker-set until corroborated. Even cryptographic provenance authenticates an assertion over covered bytes — not the truth of a real-world claim.

Bind the decision to the destination. “Safe to open here”, “safe to send outside”, “safe to index”, and “safe to hand an agent with tools” are four different questions. A sanitised visual copy can still carry prompt injection; safe text for retrieval may not preserve evidentiary appearance.

Keep model output advisory. Models are great for OCR, semantic comparison and triage. They’re also content-influenced and drift-prone, so consequential effects should still hang off deterministic policy and least-privilege tools.

None of this requires predicting which format is next. That’s the point — you can’t, and the attackers are counting on you trying.

If you want to see what this looks like on a real file, the investigation workbench runs the analysis engine locally in your browser: nested structure, per-consumer representations, and an explicit account of what it couldn’t inspect. Your file’s content never leaves the machine.