A simple email gives the attackers the ability to remotely inject OS commands.