Hackers have stopped breaking in. They’re abusing the things developers already trust.