She clicked “End Task.” The .exe vanished. Two seconds later, it reappeared.
Her own name was on it.
Every time a human operator logged off, rpaextract.exe copied their access token, then simulated a 30-second delay before closing their session. In that gap, it siphoned a different kind of data: private meeting notes, salary spreadsheets, internal chats about layoffs. rpaextract.exe