They will analyze your digital modus vivendi (e.g. what's sites you use most etc) and by exploting DNS they will forward you to a mock site that looks in every way to identical but is designed to drop malware.
One time I connected to youtube and sure enough netstat revealed some IP in virginia instead of the normal google one.
Also if you find this IP in your logs: 172.31.254.146 you being targetted for information
Now, now. They're very clever, you know.
It's actually worse than that. They're in your head - go rent "The President's Analyst."
This is positive proof that just because you're paranoid doesn't mean that someone isn't
out to get you...