A corporate security block did not always end the conversation. A joint advisory describes attackers asking targets to open disguised malware on personal devices instead, where the exposure can extend beyond work data.