The most effective phishing and malware campaigns usually employ one of the following two age-old social engineering techniques:

https://blog.sucuri.net/2019/02/hackers-use-fake-google-recaptcha-to-cloak-banking-malware.html