Phishing emails don't just target login credentials directly, but often lead victims to affiliate marketing sites.