On windows, when you (double)click on an executable file it runs, because that's the default action for executables. On Unixes you need to mark the file as executable (with `chmod`) for this to happen.

In an email client? Without any warning of sorts?

Which email client is that?

Also, for many years already, Windows won't let you run an executable that you just downloaded from the internet just by double clicking, without first clicking through a warning dialog.

Yes, but then again warning dialogs don't have much track record in preventing malware outbreaks.

For example, recent versions of Word won't run VBA macros by default without the user clicking through a warning dialog, and yet people fall for it all the time.

Malware authors don't mind either way.

I didn't say anything about that. I'm only refuting the claim that Windows email clients will run an executable just by clicking on them.

Well, then I would disagree with you there. There are plenty of ways to get Windows to run executable code just by clicking an attachment, and this even without warning dialogs:

- PDFs with JS code. It's not a joke, someone actually titled a paper on PDF exploits alone, "PDF, Let Me Count the Ways".

- Hostile RTFs (with or without OLEs) disguised as Word documents (which Office will gladly open).

- Hostile HTML disguised as Excel spreadsheets (likewise).

- New unknown variants of the old Windows metafile exploit (just by viewing, as xorcist suggested).

- Image "stegosploits" (likewise).

The list goes on...

I've literally never used a mail client that behaves this way. If the EXE even makes it past attachment scanners, I get a 'save'/'run' prompt and then if it's not signed and trusted, SmartScreen usually prompts me again to confirm that I really want to run it.

The app is usually in an installer package or ZIP which adds a couple more execute barriers.

The real threat is malware hidden in document formats like docx or pdf, which usually have fewer clicks before open + get exploited.