The most useful primary paper discussing this specific lure is the . Why this file is historically significant

In cyber threat intelligence, EroticActionHeroes.zip is cited as a textbook example of the phase of the Cyber Kill Chain. It demonstrates how attackers use enticing or salacious filenames to bypass human judgment.

: A practical guide for security teams on how to identify and pivot from indicators of compromise (IOCs) like malicious filenames.

: Provides a structured mapping of how such "lures" fit into broader adversary TTPs (Tactics, Techniques, and Procedures).