The goal of the email attack was to persuade victims to click on the main call-to-action button, *VIEW COMPLETED DOCUMENT*, included within the email. Unfortunately to the blind eye, end users cannot tell that this button contained a bad URL. When clicked, victims were navigated to a fake landing page designed to impersonate a Proofpoint Storage application. The fake landing page included Proofpoint branding and showed an icon of a PDF document, representing the completed document that needed to be viewed by the victim.