To install the malware on the targets' computers, the hackers used phishing emails that included malicious links that seemed to point to news websites, most of them Spanish dailies like El Mundo and El Pais.