Phishing emails continued to use links to external ZIP or RAR archives, which ultimately contained an executable with the extension SCR. SPEAR identified the following URLs were used in phishing attempts