According to Microsoft's investigation, the attack chain started when users were tricked into visiting exploitative websites.