The tactic is just one in a constantly expanding bag of tricks that attackers are using to get users to click on links and open malicious documents.