Deleting the source might feel like cleanup, but the click already happened, so the risk is on the device now. Deleting it also destroys evidence IT could use to see what you clicked. Disconnecting cuts off a threat's ability to spread or send out data, and reporting brings in people who can respond properly. Contain first, then get help.
