A search-result lure, a loader, a post-exploitation toolkit, and a final ransomware payload show how attackers can turn routine software hunting into enterprise compromise.