The Water Pamola attack chain      After further searching, we noticed that an online store administrator asked about a strange online order that contains JavaScript code inserted into the field where the customer’s address or company name would normally be located.