This was phone-based spear phishing, social engineering. There was no exploit.