Update: I have removed the link to the report at the request of Credit Suisse, which typically limits distribution of its full research notes and intended to do so in this case.
The phishing email in question appeared to come from the email account of another AP staffer, with a request to click a link to a "very important" article on the Washington Post website.
The rest are automatic, such as clicking a pre-configured link or having the browser execute request within a web page (for example, requests to call images and additional content from third party sites).
In the Valle case, the judge has granted a defense request to allow Sergey Merenkov to testify via video link from Russia about Darkfetishnet.com, which he founded and operates.