PAPERMILL uses fake tax-audit emails and a signed Notepad++ copy to deliver VenomRAT through malicious disk images.