Drive-by download
Hostile code lands because you visited. No attachment required. The click was the URL.
A drive-by download plants hostile code on a computer or phone without the user meaning to fetch a file. There may be no attachment and no download button. A vulnerable browser, plugin, or a poisoned ad is enough.
Keep browsers and office suites patched, kill unneeded plugins, consider blocking ads on work profiles, and do not run as admin for email. Application control stops a lot of what then tries to execute.
Fact source: ASD's ACSC glossary.