Systematic dropping of definite article makes me suspect the author may be a native speaker of some eastern language with limited knowledge of English.
Most likely it’s a deliberate attempt to target people who are excited enough by the email to not notice the grammar.
There's no "second step" to this con. You don't have to get tricked into wiring them money. If you visit the page, you lose.
There may have been a second step for the attackers goals after the zero day, e.g. ransomware or some other social engineering