The VPN connection was still active. He was "secure," hidden behind a wall of encryption, but the text file implied he had just invited a trojan into his system. Or worse, simply by viewing the list, he had flagged himself.
The subject line you provided refers to a type of file—often found on forums or file-sharing sites—that claims to contain a list of leaked or shared "premium" account credentials (email and password combinations) for ExpressVPN. X728 EXPRESS VPN PREMIUM ACCOUNTS.txt
He went back to the text file. He needed to check the bottom of the document. Usually, that’s where the signature or the malware payload hid. He scrolled past hundreds of names—lawyers, doctors, teenagers, corporate executives. The sheer volume of data in X728 was staggering. The VPN connection was still active