“There,” she said. A single DNS query to a domain she didn’t recognize. audit-verification.internal.corp . It resolved to an internal IP. That IP belonged to a server in the audit department’s own VLAN.

She pulled up Daniel Oakes’s network logs from before isolation. The last clean hour of his machine’s life. DNS requests. HTTP calls. Nothing unusual until—

That left one option she didn’t want to consider: something had exploited the client through its own self-protection logic . A flaw in the tamper-proofing. A crack in the armor from the inside out.

“It’s spreading,” she said. “Not fast. Patient. It’s not a worm—it’s a trigger. The malware sits there, does nothing, waits for each client’s scheduled integrity check. Then it whispers the lie. And the client destroys itself.”