It occurs when an attacker dupes a victim into opening an email, instant message, or text message.