Attackers sometimes upload fake video files with double extensions (e.g., Episode01.mkv.exe or .scr ). Also, indexes are rarely maintained, making them ideal for hosting malicious scripts.
(behind, preview, director’s cut)