Sophos advises anyone who suspects they’ve interacted with these links to change their passwords immediately.