Since late November, Angel Drainer, the tool used in the Ledger hack, has been leveraging a smart contract to modify static file domains.

Source and More information: Tool used in Ledger hack altered file domains since November

Author: BTCManager.com