Hard to say how the SD let's it in.
My guess is the 'notifications' option. Someone on a government-computer gets notified about something from a pedestrian-type site, because they never went to their personal-page to click-off 'allow notifications'. The worm walks right in...