Google's latest threat report warns that third-party tools are now prime targets for attackers - and businesses have only days to secure them.