Under what circumstances would a link you click on a website or an email _ever_ be a trusted file?
> I've attached familyphotos.zip -- here you go!
The email client will presumably have a link below called familyphotos.zip, but the email client ALSO link-ified the text familyphotos.zip to download the content at https://familyphotos.zip, which is untrusted but you don't realize it doesn't go to the same familyphotos.zip file.
Screenshot: https://twitter.com/mholt6/status/1657133439546695680
Update: Turns out it just contains what_happened.txt, a copy of which is below. Thanks anonymous person!
```
"Hey, this isn't family pictures!"
You're right -- and that link you clicked wasn't a file attached to the email or message you received.
Thanks to Google[0][1], now it's impossible to discern the difference between a link to an attachment called "familyphotos.zip" and a link to this file... unless you are able to inspect the destination of a link before clicking it. Most software and apps don't allow that, and most people don't know how to tell the difference anyway.
Have fun in the Wild Wild Web!
[0]: https://www.blog.google/products/registry/8-new-top-level-do... [1]: https://twitter.com/Google/status/1653866291692728320
```