Encrypted payloads delivered via fake media player or codec updates.
Look closely at the top-level domain (e.g., .com, .org, .net). Be wary of unusual or obscure extensions (like .xyz, .top, or .biz) which are statistically favored by spam networks. juq496 link