The greeting was a disguise, not the infection
A teddy bear bouncing across the screen looked like a harmless animation. But the file attached to an email could be an executable: a program the computer runs when someone opens it. Unlike an ordinary picture, which mainly displays stored image data, an executable can carry out instructions.
That distinction made the e-card appealing as bait. The recipient thought they were opening a seasonal greeting; in reality, they might be launching code that could harm the computer or help spread malicious software.
Why people opened the attachment
The trick relied on a familiar social habit: people are more willing to open a file when it appears to come as a friendly surprise. A cute image or holiday message supplied a plausible reason to click, while the danger was hidden in the file’s actual format and behavior.
This is a form of social engineering—using people’s expectations and trust to get them to do something a technical attack needs. The attacker did not have to make the harmful program look frightening or sophisticated. It only had to look like something the recipient wanted to see.
The click was the critical step
In the late 1990s and early 2000s, opening an attachment could start the program inside it, depending on the computer’s settings and the file involved. Once run, malicious code might interfere with the machine or attempt to reach other people through email. The animation was therefore part of the lure, not proof that the file was safe.
The lasting lesson is concrete: a file’s appearance and its function are not the same thing. A charming greeting could be the wrapper around a program, and the decisive moment was not admiring the bear—it was allowing the attachment to run.
