Researchers from Unit 42 have discovered that threat actors are using malicious JavaScript to steal sensitive information by exploiting popular survey sites, low-quality hosting, and web chat APIs.