Human IT managers thought they were being nice to the boss, but were assisting a threat actor