If I understand it, then, someone opens the initial payload which allows malware to be downloaded- and this downloaded malware orchestrates the "spear phishing?"
I haven't seen this as I've been out of an organization for quite a while. Thanks for clarifying.
