"most virus scanners miss a frighteningly large fraction of malicious attachments."
That's because the attachment isn't malware or a virus. It's just a link that takes you someplace where you get asked to fill out forms and enter banking information just like any shopping portal. It might be trying to get you to dl a piece of software. It's as bad as all of the QR codes that people will just scan without a thought. I've had people want me to get a virtual business card from them by scanning a QR code on their phone and I just have to shake my head and walk away.