Researchers say the highly effective social engineering technique is no longer the exception for malware attacks — it's now the rule.