Exploit known browser vulnerabilities - Launch Java/Flash exploits (legacy) - Inject keyloggers - Redirect to exploit kits