The threat actors would frequently pose as an employee of the fictional media publication “Australian Morning News” and provide a URL to their malicious domain. If a target clicked the URL, they’d be sent to the fake news site and be served up the ScanBox malware.