According to Fortinet security expert Cara Lin, the attack begins with a phishing email