A little late to the thread, but I had a similar experience this week.
I was contacted by someone seemingly wanting to know if I could produce something and a link was provided, to what one would assume to be a picture or example. Replying resulted in the same 'invalid user' message. Red flag, right there. Send such messages to you SPAM folder and think nothing more of them.
Anyway...
Be VERY cautious with links pointing to sites external to Etsy. In most cases, don't click them. That said, I'm former IT and possess capacity for operating in and downloading to a sandboxed environment. I was curious, so the link was clicked.
It pointed to a self-extracting zip archive containing a single batch script. Code obfuscation had been implement using a boatload of assigned variables, and in the end, the intent was to start powershell in the background and initiate a few downloads, uploads, and modifications to user/system files. Chrome would be started and a site loaded, presumably to grab the user's attention while it all took place.
Someone's trying to steal credentials and gain access to user accounts, guising the attempt as a request and potential order... or perhaps it's a ransomware attempt. I dunno and don't care to dig any further into it.
Not being a Windows user in the first place, it wouldn't have been ineffectual on my end anyway, and ought not be effectual on a properly configured Windows system, but there it is.
Be wary, folks.
Regards.
