Maybe have them click a .zip link that takes them to a web page which asks for an account password to open the "archive"? I could see that getting under a few

Maybe have them click a .zip link that takes them to a web page which asks for an account password to open the "archive"? I could see that getting under a few people's radars, but it's not much more menacing than existing fishing tricks with lookalike urls.