How auto-scanning and scripting helped Exchange attackers rack up victims