Exactly, they’re not stupid. So you’d expect them to use a spell checker if they intended for the attack to have a high success rate on English speakers.

There may have been a second step for the attackers goals after the zero day, e.g. ransomware or some other social engineering