Attackers turned OpsShield's own signing keys against its customers, shipping a malicious cPGuard build that ran with full privileges.