Years-old domains, compromised JS libraries and worldwide-localized content among tactics of this sophisticated attacker.
