A new report reveals how attackers are exploiting a familiar Windows app to access sensitive data. Here's what's happening.