The subject line was relevant to multiple departments (HR, management, administration) - The email was sent to a small number of specific targets, avoiding mass-email detection - The attachment appeared to be a standard business document - Only two phishing emails were sent — an extraordinarily targ