Cross‑tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook