A professional hacker explains how he dupes people into clicking on malicious links