Standard malware links rely on the user installing an obvious virus. The ecosystem is different because of dynamic payload delivery and geo-fencing .