malicious tool loading