Creating spoofed email addresses that closely resemble legitimate ones. Using urgent language or scare tactics to prompt immediate action. Embedding malicious links that redirect to fake websites designed to capture sensitive information. Including malicious attachments that, when opened, install malware on the victim's device.