Security experts last week warned that hackers are preparing Christmas card emails that appear to lead to innocent images, but in fact trick users with Windows systems into downloading viruses.

To avoid difficulties, firms should check their mail filtering systems to ensure they handle emailed images in the same way as other HTML traffic, and should also educate users about this issue.

Security specialist ISS said contributors to hacker mailing lists have recently been discussing new techniques to bypass firewalls by mislabelling general HTML files as JPEGs. Steven Darrall, senior consultant at ISS X-Force Security Assessment Services, said the problem is caused by Microsoft's Internet Explorer (IE) web browser automatically opening files labelled with .jpg or .gif extensions. "If the file does not contain an image, IE will try and guess the content," Darrall said.

The news could explain the recent increase in the number of spam-like emails that contain JPEG files that do not actually include an image.

"This could turn into a big problem," said Darrall. "For example, email worms were thought not to pose a high risk because people thought their antivirus systems would handle them, without realising that antivirus systems are not always regularly updated."

Hackers have posted a proof-of-concept file in which the content was a script that caused the browser to download and install a virus, Darrall said. The site serving the virus has since been shut down, but Darrall warned that the online discussions could be the first sign of trouble ahead.