CERT-UA links the AgingFly credential-stealing campaign to phishing, browser theft, and modular remote access.