Crossed Signals

Endpoint forensics investigation tracing a vishing-driven credential theft from an AiTM phishing page through RDP reuse and a failed RMM deployment to targeted legal document collection, with the attacker's own Signal conversation recovered via the DPAPI key chain.