A Refusal in Writing, Answered Two Minutes Later

A targeted spearphishing message used a realistic PDF-labelled attachment chip that redirected through a click-tracking service to an attacker-owned domain; a customer-service representative correctly refused and asked verification, but the attacker replied promptly from a Gmail account and attempted to socially engineer the user into opening the link. The report includes indicators of compromise (email, phone, URLs, domains), MITRE ATT&CK mappings (T1566.002, T1585.002, T1204.001, T1608.005), and argues that detection plus a one-click escalation path is needed because correct user refusals alone do not stop live negotiation attacks.