Spear phishing, as its nicknamed? If something is sophisticated enough to work, don't knock it!

There's no fundamental difference between the basic techniques used by malicious hackers, organised crime, pentesters or nation-state adversaries doing offensive "cyber-operations" (ugh): the only big difference is the budget (time, personnel, money), how likely they are to get away with it, and how aggressive they are.