Researchers found font-rendering trick to hide malicious commands