Yes. It seems the user executes an attachment that's a PIF file (a type of shortcut file) that writes out a PS script to the temp directory and executes powershell.exe to run it. The point of highlighting PS in the article appears to be that previous distribution of this malware used a different mechanism, not anything wrong with PS itself.