Upon clicking the link, malware can be downloaded onto the user's device to spy on their activity or collect their data. The malware will appear to run as a legitimate download. It can then hide in legitimate folders and not do anything malicious instantly, leaving the victim thinking they just opened a remittance pdf.