There have been literally thousands of documented incidents of this.
There's an entire subsection of the security industry dedicated to this happening. The DefCon international security conference holds an on-stage competition where security researchers demonstrate this happening to real targets in real time in front of a live audience.
> There have been literally thousands of documented incidents of this.
Of making people export all their credentials from a password manager and send them to a scammer?