Attackers use HTML smuggling to spread the PlugX RAT in the campaign, which has been ongoing since at least December.