How hackers can make ‘virtually any person’ click on a dangerous link