Chinese-linked hackers weaponized a WinRAR flaw to embed persistent spyware in Southeast Asian governments, exposing new risks in everyday tools.