Cross‑tenant helpdesk impersonation to data exfiltration