Don't open any attachments, unless you know that they are coming in advance.
Even if you know the person in the "from" field of the message, don't trust the message if it comes with a short, vague, or odd-sounding message like "for your review", or an attachment that ends in .exe, .pif, or .zip