Hm, a give-away would be that the image would most likely not be interactive like it is now for me (Chromium). I.e. a PDF attachment footer "icon" renders the p

Hm, a give-away would be that the image would most likely not be interactive like it is now for me (Chromium). I.e. a PDF attachment footer "icon" renders the preview, and then action buttons when hovering the mouse over it. The buttons are then changed to darker colours with alt text when hovering over them again. Or did they manage to embed the JS to simulate these actions with the attack?