New research shows that up to a half of all HTML email attachments are malicious, and not just because of a few massive campaigns.