That all it takes is for such info to be on a cloud system (Facebook, Twitter, any number of cloud sync systems) or for one of your contacts that you sent a CC email to to be infected. As well as the fact that EMAIL is not sent encrypted. Let's dwell on that for a moment.
Since EMAIL passes through many mail servers on its way to all of us, the email headers are in the clear for capture. With thousands of mail servers it is not much of a stretch to have some bad actors out there.
It gets worse the more you research. EMAIL today is based on a system from 1984 (strange that year?) and from a time when we didn't encrypt it all.
At the very least, your choice of antivirus should scan email in your email app.
Since 2 weeks ago Im Receiving emails telling me that I have an "invoice", these emails have an attachment that seems to be a virus.
The thing is these emails come using the name of my real outlook contacts, but using very rare email address (in some case using two @). Its happening with 3 diferent account , all of them configured on my Outlook.