Real-world examples: Analysis of popular "KMS activators" for Office has repeatedly found that they install password stealers, clipboard hijackers (redirecting cryptocurrency addresses), and persistence mechanisms that survive OS reinstallation.