When the victims land on the rogue Juniper website, they were instructed to install a VPN client, in this case, attackers used a legitimate software from Juniper Networks packaged with the Helminth malware.