A themed ISO, a disguised Windows shortcut, and a Google Sheets command channel show how ordinary tools can be stitched into an espionage workflow.