User clicks an email attachment and then it spreads internally. Extremely common.