Because That's What It Takes To Get People To Click

from here

Attackers are only as sophisticated as they need to be, and considering the sorry state of most organizations' security that means most are not very sophisticated at all.