The potential of Reconfigurable Intelligent Surfaces (RISs) for energy-efficient and performance-boosted wireless communications is recently gaining remarkable research attention, motivating their consideration for various $5$-th Generation (5G) Advanced and beyond applications. In this paper, we consider a Multiple-Input Multiple-Output (MIMO) Physical Layer Security (PLS) system with multiple data streams including one legitimate passive RIS and one malicious passive RIS, with the former being transparent to the multi-antenna eavesdropper and the latter's presence being unknown at the legitimate multi-antenna transceivers. We first present a novel threat model for the RIS-boosted eavesdropping system and design a joint optimization framework for the eavesdropper's receive combining matrix and the reflection coefficients of the malicious RIS. Focusing next on the secrecy rate maximization problem, we present an RIS-empowered PLS scheme that jointly designs the legitimate precoding matrix and number of data streams, the Artificial Noise (AN) covariance matrix, the receive combining matrix, and the reflection coefficients of the legitimate RIS. The proposed optimization algorithms, whose convergence to at least local optimum points is proved, are based on alternating maximization, minorization-maximization, and manifold optimization, including semi-closed form expressions for the optimization variables. Our extensive simulation results for two representative system setups reveal that, in the absence of a legitimate RIS, transceiver spatial filtering and AN are incapable of offering non-zero secrecy rates, even for malicious RISs with small numbers of elements. However, when an $L$-element legitimate RIS is deployed, confidential communication can be safeguarded against eavesdropping systems possessing even more than a $5L$-element malicious RIS.