On Linux/macOS:
Phishing email → Attachment: XBDXN.7z → User extracts → Hidden .lnk or .vbs file → Downloads additional malware (ransomware, stealer) XBDXN.7z