Comprehensive and Detailed Explanation (ECIH-aligned):

The ECIH Introduction to Incident Handling module identifies social engineering as a primary method attackers use to gain unauthorized access without exploiting technical vulnerabilities.

Option C is correct because the attack relied on deception—spoofed notifications and lookalike domains—to trick users into disclosing credentials. This is a classic social engineering technique, often used as the initial access vector.

Options A, B, and D are technical reconnaissance or network attacks, not human-focused deception.

Recognizing social engineering as the root cause is essential for selecting appropriate remediation actions such as user awareness training, phishing defenses, and MFA, all emphasized in ECIH guidance.