[kerng]

This is especially true for reflected attacks, besides doing target spear phishing via email or messenger apps it won't be succesful.

For persistent attacks, its mostly just sit and wait for an attacker - they don't really control when/if a user visits the compromised page.