A fake CAPTCHA says press Windows-R, paste the verification code, hit Enter. The code is a PowerShell download cradle, and it runs with your full user authority, past every browser sandbox. Why this trick works, the variant families, and the one rule users can memorise that kills the whole class.
Your leaked row enters an industrial pipeline within hours: deduped into combo lists, tested against banks, inboxes and corporate SSO, cross-joined with infostealer logs, and resold — often before the breached company finishes its investigation. Attackers do not want your data; they want your password against everywhere you reuse it.
Two AI security incidents in 48 hours: Bleeding Llama (CVE-2026-7482, CVSS 9.1) leaks full process memory from 300K+ exposed Ollama servers via malicious GGUF files, while a fake OpenAI Privacy Filter on Hugging Face hit #1 trending and delivered a Rust infostealer to 244K+ victims. Verification and patching playbook inside.
Fileless attacks deleted their tracks from disk years ago. The injected shells, decrypted payloads, and cached credentials that decide an investigation live only in RAM. The acquisition-to-attribution workflow: Volatility 3 triage, MemProcFS deep dives, and the corroboration step that makes findings stand up.