[dhimes]

If I understand it, then, someone opens the initial payload which allows malware to be downloaded- and this downloaded malware orchestrates the "spear phishing?"

I haven't seen this as I've been out of an organization for quite a while. Thanks for clarifying.