tl;dr - "ultra advanced cyber persistent cyber threat cyber actors" are sending phishing emails and people are still clicking on them.
I can excuse (sort of) clicking on infected files. Honestly, how many of us are checking unsigned e-mails' headers in the source code? At the very least we should confirm if the displayed From and Reply-to match the originating server.
But we usually don't. And we may be on webmail(!) on someone else's computer. That PDF could have malicious software.
*
Clicking on a suspicious link is one thing. Doing something on that linked site is worse. (instead of re-typing the URL -- I hate internationalized URL domains for making this hard.)
Not checking the URL or even looking for the green padlock or using common sense and then typing in your password??? No excuse.
Would a bank ever send you a postcard asking you write down your PIN and bank balance on the postcard and send it back to them? No. Of course not. For starters, they don't need that information.
Clicking on phishing links and entering personal information is stupidity on a whole new level.
Why spend weeks/months searching for 0-days and hoping they will remain viable when you can spin up a fake login page and a bit.ly, find the people to target and send the targeted emails in a couple of days, max?