The one where we got their client’s data by simply asking nicely.
A year-long business email compromise campaign built entirely on AI social engineering: lookalike domains, a fabricated authority figure, and patient trust-building. No malware, no exploits, just an inbox and the words "this is approved."