Can you give a source for that?

I keep asking for it and never had any good response. The best I have found is that it helps show phishing. A link that said "Install me" and trigger the download of an executable when you click on it doesn't make HTML responsible for malware infections.