Legitimate software updates are usually several megabytes; small "invoice" zips (under 500KB) are often malicious.
Often found in "invoice" or "shipping" phishing emails. ebe5ammq4637.zip
Distributed via ad-networks or file-sharing platforms. ⚠️ Security Warning ebe5ammq4637.zip