Núclea, a Brazilian financial services technology company, thwarted a sophisticated phishing attack using compromised credentials from a legitimate government institution that appeared entirely trustworthy. Darktrace identified a malicious URL embedded in a PDF and rewrote it to prevent the malicious download while leaving the rest of the email intact. The case illustrates how behavioral AI detects subtle deviations from normal patterns that signature-based tools miss entirely.