I Investigated a Real Phishing Attack — Here's the Full Kill Chain

A real spearphishing incident I handled from ticket to remediation. Full attack chain reconstruction, forensic analysis, IOC extraction, and the mistakes that cost us days.