“No Phishing. No Malware. Just a Phone Call… and the Entire System Was Compromised.”