According to Binance, the “zero-day malware” used obfuscation and evasion techniques to ensure it was not detected by the engineer’s endpoint security tools. These included replacing a legitimate development tool component with a malicious version to execute commands and connect with a C2 server.