To bypass Email security, attacker sends mail with Google link, which downloads a REV archive.
This archive has 2 files, one is a text file saying "hey password is 123", other is pass protected archive with exe
Exclude trick
Set-MpPreference -ExclusionExtension exe,bat,dll,ps1