WebRTC skimmer exploits PolyShell flaw since March 19, hitting 56.7% stores, enabling stealth data theft bypassing CSP.
DeepLoad exploits ClickFix and WMI persistence to steal credentials, enabling stealth reinfection after three days.