The tool hadn't hacked Facebook. It had hacked Leo. In the minutes that followed, his personal files were encrypted, his browser passwords were exfiltrated, and his own social media accounts began broadcasting the very download link he’d used, spreading the infection to his entire contact list.
