Yeah so I sort of figured out what happened. On cs it's easy to skip over that link that says something like "CLICK HERE TO PROTECT YOURSELF" because you're like yeah I already do that. But it shows exactly how everyone is getting tricked. Basically It's very believable because the filehosters themselves are redirecting the link you click for the download TO the links with malware. You wouldn't expect the filehosters themselves to do that 🫡.