Promises of high returns or free crypto with little to no effort.
Requesting you to disable security or enter a password for a .rar file to "avoid false positives".
Distributed via social media (TikTok, Telegram) or unofficial file-sharing sites rather than registered platforms.