An analyst is observing unusual network traffic from a workstation. The workstation is communicating with a known malicious site over an encrypted tunnel. A full antivirus scan with an updated antivirus signature file does not show any sign of infection. Which of the following has occurred on the workstation?

(A) Zero-day attack
(B) Known malware attack
(C) Session hijack
(D) Cookie stealing