     Figure 1. The login panel of BIOPASS RAT       Figure 2. Code showing the watering hole attack injection     The injected script will try to scan the affected host by sending HTTP requests to a list of ports.