credential-access 1 Fake captcha, five layers of RC4, and a Rust stealer with LSA session enumeration and AD recon Jun 11, 2026