Malicious code can silently copy and transmit databases, configuration files, and API keys to third-party servers.