tokens: The attackers behind this campaign went to some lengths to disguise their activities, including using domains names disguised as antivirus AV company websites for their command and control C C servers.