The most common way is for users to just download and execute it from a website or in an archive over email. No vulnerability exploitation needed, the guys that

The most common way is for users to just download and execute it from a website or in an archive over email. No vulnerability exploitation needed, the guys that actually use vulns install a rat in addition to stealers and sell access to the computer/network.