That's my understanding. The attachments come as zip files, and the nasty part of this one appears to be that it can steal addresses and arrive as a message from a familiar source.