Attackers use the comment feature in Google Docs to email victims and lure them into clicking malicious links.