offered a .exe file instead of a .zip , claiming it was an "installer wrapper."

By the time he realized the "Fullversion zip" was actually a credential stealer, his email provider was already sending alerts about "unauthorized logins" from three different continents.

The file sat in his downloads folder: DroidTransfer_Portable_Full_Crack.zip . It was suspiciously small—only 2 MB. When Leo unzipped it, there wasn't a program inside. Instead, there was a single file named Instructions.txt and a hidden application icon that looked like a folder.