How Water Labbu Exploits Electron-Based Applications

The infection is initiated when the initial scammer (in essence, the victim) opens a weaponized webpage (likely sent to them via livechat). It leveraged XSS techniques to force the exploit to be rendered in a window without sandboxing.