No. The zip file contains a JavaScript file that the user has to click on to get infected. Typically, the target is Windows, which hides the file extension of k

No. The zip file contains a JavaScript file that the user has to click on to get infected. Typically, the target is Windows, which hides the file extension of known file types by default. So the user ends up seeing a file called 'transactions 31234' (actual example), which has an icon depicting a document. Double-clicking on it causes the script to execute in Windows Script Host (WSH), which gives the script access to internal Windows APIs.