I'm still guessing it's the support email platform they are using...
Btw what the file does is download something from dropbox that will send your wallet.dat somewhere and delete yours. This can easily be prevented by not having it at the default location.
Thanks, it's good to know what it does. Hopefully, I escaped. My .dat files were still intact, but I guess they're compromised. I've transferred everything to new wallets.