Since late November, Angel Drainer, the tool used in the Ledger hack, has been leveraging a smart contract to modify static file domains.