A user receives an unsolicited call from a technician claiming to be from a Microsoft certified partner. The technician tricks the user into allowing them access to their PC because of malware…

Shoulder surfing involves physically observing someone's screen or keyboard to steal information and requires the attacker to be physically present.

Phishing is a deceptive attack delivered via email or malicious links, not through an unsolicited voice call from an impersonator.

Social engineering is the practice of psychologically manipulating people into performing actions or divulging information by impersonating a trusted authority - in this case, a fake Microsoft partner technician. The attacker crafted a convincing false pretense (malware alerts) to gain the user's trust and consent for remote access. No technical exploit was used; the attack succeeded entirely through human deception.

A malware infection refers to malicious software being installed on a system; while remote access tools may be used after the social engineering succeeds, the attack vector itself is human manipulation.