A newly documented BlankGrabber infection chain is using a bogus “certificate” loader to disguise a multi-stage Windows compromise, adding another layer of deception to a commodity stealer already ...

Instead of the usual phishing email or fake download page, attackers are using Google Forms to kick off the infection chain.

When custom tools beat built-in ones.