When a user searches they assume clicking a button starts a safe download. In reality, the process is designed to trap users.