[nueded]

This is a TOR exploit in the same way that downloading a blob through TOR is a TOR exploit.

[campuscodi]

Nobody said it was a Tor exploit. It's just a deanonymization technique, which like most, rely on social engineering (convincing the user to push a "Save File" button).

[kristofferR]

Would simply saving it, without opening it, execute it?