Cybercriminals are discovering that a little empathy is often more effective than malware when the fake boss treats employees better than the real one.