'Hybrid' spear-phishing may lead next wave of major hacks; don't pick up the phone