Advanced threats occur in “kill chains” of up to seven stages. Not all threats need to use every stage, giving cybercriminals hundreds or even thousands of ways to create and execute data-stealing attacks.

In the RECON stage, cybercriminals research their intended victims using personal, professional and social media websites. They’re looking for information to help them create seemingly trustworthy “lures” that contain links to compromised websites under their control. Some lures use recent disasters, social drama or celebrity deaths to draw on human curiosity.