Audit identifies credential harvesting, C2 callbacks, and data exfiltration patterns across 18.7% of the most popular ...