Here's a typical scenario:
Sarah frowned. She knew a David Miller at a partner firm, but they usually spoke over Slack. She opened the email.
This was not a malware download. It was a "Man-in-the-Middle" credential harvesting attack.