Hacker News Reader

The sophistication here (SVG > CHM > fileless execution > dual payload) suggests access to commercial malware toolkits rather than bespoke APT development.

View on HN

And, it might be taking longer to discover because it's hard to notice with SVG.

Reply on news.ycombinator.com