tokens: From a single instance of the encoded JavaScript discovered in one version of this malware, we pivoted on the Command and Control C2 IPv4 address discovered during static analysis and deobfuscation, using our Threat Intelligence Service AutoFocus, unearthed many more versions of the malware and found that the versions seen to date were delivering a credential-stealing Trojan as the final payload.