Deliver Payload via Malicious Phishing Link

Adversaries may use social engineering to persuade a user to click a malicious link in order to gain code execution. The link may trigger browser or application exploitation or lead to a download; if the user must open a downloaded file to execute it, that follow-on action is User Execution: Malicious File (T1204.002). Email link delivery is the separate Phishing: Spearphishing Link technique (T1566.002) and commonly precedes this user-execution behavior.