Comment by spatley

Is the exploitation further expecting that the evil link will pe presented as a part of chat response and then clicked to exfiltrate the data in the path or querystring?