A campaign using fake humanitarian documents, GitHub-hosted payloads, and Python spyware shows how ordinary trust cues can be turned into an access path.