A financial services company discovers that several employees' workstations were compromised after visiting an industry news website that they routinely browse for work. Forensic analysis shows the legitimate website was previously breached and serving malicious code that exploited visitors' browsers. The attackers appear to have specifically targeted employees of firms in this sector. Which type of social engineering attack does this scenario describe?