In most cases, email is the first to deliver: 1. The initial URL, in the form of a link to an exploit kit or phishing website. 2. The attachment, in the form of a dropper or payload. 3. The starting point for a social engineering attack, such as in the case of BEC or credential phishing attacks.