I looked at an early flavor of this and spent a while reversing the malware. This was the same malware that hit McClatchy and MediaNews a few years ago (2020, b

I looked at an early flavor of this and spent a while reversing the malware. This was the same malware that hit McClatchy and MediaNews a few years ago (2020, but I remember being concerned about the malware's practice of replacing the DOM with the lure and how that could have been further abused to inject fake content). It ran on many regional media sites like Denver Post, etc. This one did a lot of cleverness like fingerprinting a host via JS to ensure it was legitimate, geolocating an IP, only serving the bait once to an IP, and making sure the referrer header was set-- among other things. They also had a nice pool of domains, but they were discoverable by looking for artifacts specific to the lure. It was an interesting campaign to dig into and watch evolve. If I recall too, the intermediate domains appeared to all be subdomains from (possibly) compromised godaddy accounts.