Fun one, malware email in .xz attachment - 7-zip and WinZip unpack. Batch file. Calls myp0nysite dot ru and https://www.virustotal.com/en/file/e87173f4959560aa910d67d61542594a80292dadeec512af1201b556fa174e0a/analysis/ …pic.twitter.com/3DIfOG9LW7
You can add location information to your Tweets, such as your city or precise location, from the web and via third-party applications. You always have the option to delete your Tweet location history. Learn more
Last I checked, 7zip doesn't support Mark of the Web (MoTW), so I could see reasons for attackers picking formats it supports.