The malicious weblink can be an advertisement, or a legit webpage that got compromised/XSS'd, or a formerly legit webpage whose domain has expired. (AFAIK this

The malicious weblink can be an advertisement, or a legit webpage that got compromised/XSS'd, or a formerly legit webpage whose domain has expired. (AFAIK this is pretty common) The email attachment may come from your friend/business partner which themselves got infected and the malware is now attaching itself to their legit emails. (AFAIK not very common)