Real PIFs are indeed “only” configuration files, but they are executable: running a PIF will run the corresponding program, with the configuration specified by the PIF. This can be used as-is: a “real” PIF can be sent to a user, and if that user runs it, the commands specified in the PIF will be run; starting with VMM 4.0 (Windows 95), PIFs can even include
AUTOEXEC.BAT instructions, so multiple commands can be chained.
However malware disseminated using PIFs generally relies on the fact that DOS and Windows don’t use an executable file’s extension to determine how it is run, only to determine that it is an executable.
PIF mark files as executable, equally. So you can take a regular Windows
EXE file (with nefarious content, in this scenario), rename it with a
PIF extension (thus evading naïvely-configured mail filters, and seeming less dangerous to users unlikely to be aware of this file extension), and Windows will execute it — its
PIF extension marks it as executable content, and when Windows is asked to execute it, it won’t complain that it doesn’t contain a PIF database, it will see that it’s a program and run it.
(Executable content is identified by its MZ and PE signatures.)