It's not buried; it's in the 2nd sentence of the abstract/summary:

"leveraging a subdomain takeover vulnerability"