Email attachments remain a primary malware delivery method, especially unexpected ones. Verify with the sender before opening any file you weren't anticipating, and never run executables from email.
“Didn't expect the attachment? Don't run the attachment.”