Said simply, Lazarus — in one way or another, either through phishing, infection via malware or a faulty Chrome plugin — was able to put a screen in front of the multi-sig holders that made it seem like they were interacting with a familiar platform that was actually a backdoor to drain their funds.