So, basically, an upmarket phishing scheme where an employee should have known better. Nevertheless, a very nicely put together scam, which I'm sure we'll see many more of - because not everybody knows how to write malicious code