We see some of this with just normal spear phishing against companies. The "single click" thing is reasonably common, it makes things a bit harder to catch as often the clickthrough will change to whatever is being spoofed in the first place. A homophone ycornbinator.com would serve the malware first time, then next time it would send a permanent redirect. Unique IDs you'll see in things like spam SMS, both to work around automated blacklisting, but also to work out who clicked through and who might be a potential mark the next time even if they didn't completely fall for the scam.

Most of what we got was recycled RAT malware with various packers though, it didn't trend towards being particularly interesting because you usually don't need to be to catch people, at least that's my impression. Maybe it's bad toupee fallacy.