Since late November, Angel Drainer, the tool used in the Ledger hack, has been leveraging a smart contract to modify static file domains.
Go here to Read this Fast! Tool used in Ledger hack altered file domains since November
Originally appeared here:
Tool used in Ledger hack altered file domains since November