The threat actors distributed malicious JS scripts disguised as legitimate business documents, primarily in ZIP archives with names like "Purchase…