Cloudflare has detailed how a phishing attacked duped employees – and says the attackers are targeting other companies too.